Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Aug 14, 2025
Malicious code in compress-img-and-upload-to-s3-securely-pretty-please-with-sugar-on-top (npm)
- Aug 14, 2025
Malicious code in compress-decrypt-load-kernel-delta (npm)
- Aug 14, 2025
Malicious code in composer-connector-harmony-hlfv1 (npm)
- Aug 14, 2025
Malicious code in component-emiter (npm)
- Aug 14, 2025
Malicious code in component-dfp (npm)
- Aug 14, 2025
Malicious code in component-adhese (npm)
- Aug 14, 2025
Malicious code in componenet-classes (npm)
- Aug 14, 2025
Malicious code in compliantcenter (npm)
- Aug 14, 2025
Malicious code in compliancereadserv (npm)
- Aug 14, 2025
Malicious code in compiti (npm)
- Aug 14, 2025
Malicious code in compile-serialize-uglify-book-simulate (npm)
- Aug 14, 2025
Malicious code in compile-dog-resolve-java-slow (npm)
- Aug 14, 2025
Malicious code in compilat (npm)
- Aug 14, 2025
Malicious code in compares (npm)
- Aug 14, 2025
Malicious code in companies-matcher (npm)
- Aug 14, 2025
Malicious code in comons-paypal (npm)
- Aug 14, 2025
Malicious code in como-rastrear-un-iphone (npm)
- Aug 14, 2025
Malicious code in como-rastrear-un-celular (npm)
- Aug 14, 2025
Malicious code in como-hackear-whatsapp (npm)
- Aug 14, 2025
Malicious code in como-hackear-un-facebook (npm)
- Aug 14, 2025
Malicious code in como-espiar-whatsapp-sin-codigo-qr (npm)
- Aug 14, 2025
Malicious code in como-espiar-whatsapp-de-forma-segura (npm)
- Aug 14, 2025
Malicious code in commtool (npm)
- Aug 14, 2025
Malicious code in commsecjs (npm)
- Aug 14, 2025
Malicious code in commqnder (npm)
- Aug 14, 2025
Malicious code in commons-paypal (npm)
- Aug 14, 2025
Malicious code in common_controllers (npm)
- Aug 14, 2025
Malicious code in common-styles (npm)
- Aug 14, 2025
Malicious code in common-server-utils (npm)
- Aug 14, 2025
Malicious code in common-pointer-cellotrack-api (npm)
- Aug 14, 2025
Malicious code in common-node-libraries (npm)
- Aug 14, 2025
Malicious code in common-modal-module (npm)
- Aug 14, 2025
Malicious code in common-js-support (npm)
- Aug 14, 2025
Malicious code in common-angular-test (npm)
- Aug 14, 2025
Malicious code in commodity-node (npm)
- Aug 14, 2025
Malicious code in commnader (npm)
- Aug 14, 2025
Malicious code in commmander (npm)
- Aug 14, 2025
Malicious code in commitlint-unuk-cypress-xml (npm)
- Aug 14, 2025
Malicious code in commitlint-mutation-tectonic-html-webpack-plugin (npm)
- Aug 14, 2025
Malicious code in commitlint-juno-cors-paleoecology (npm)
- Aug 14, 2025
Malicious code in commitlint-equinox-markdown-pdf-draco (npm)
- Aug 14, 2025
Malicious code in commitlint-cordelia-pegasus-playwright (npm)
- Aug 14, 2025
Malicious code in commitlint-config-angular-vega-ini-figures (npm)
- Aug 14, 2025
Malicious code in commitizen-tailwindcss-buffer-publish (npm)
- Aug 14, 2025
Malicious code in commitizen-gemini-magellan-cygnus (npm)
- Aug 14, 2025
Malicious code in commitee (npm)
- Aug 14, 2025
Malicious code in commender (npm)
- Aug 14, 2025
Malicious code in commenci (npm)
- Aug 14, 2025
Malicious code in commanedr (npm)
- Aug 14, 2025
Malicious code in commandre (npm)
Page 6072 of 7,293