Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Aug 14, 2025
Malicious code in com.unity.purchasing (npm)
- Aug 14, 2025
Malicious code in com.unity.nuget.newtonsoft-json (npm)
- Aug 14, 2025
Malicious code in com.unity.nuget.mono-cecil (npm)
- Aug 14, 2025
Malicious code in com.unity.modules.jsonserialize (npm)
- Aug 14, 2025
Malicious code in com.unity.modules.imgui (npm)
- Aug 14, 2025
Malicious code in com.unity.ext.nunit (npm)
- Aug 14, 2025
Malicious code in com.unity.cloudbase (npm)
- Aug 14, 2025
Malicious code in com.unity.addressables (npm)
- Aug 14, 2025
Malicious code in com.unity.2d.tilemap (npm)
- Aug 14, 2025
Malicious code in com.revmob.sdk.cordova.plugin (npm)
- Aug 14, 2025
Malicious code in com.nosuchstudio.rtltmpro (npm)
- Aug 14, 2025
Malicious code in com.mobilebridge.cordova (npm)
- Aug 14, 2025
Malicious code in com.microsoft.spatialaudio.spatializer.unity (npm)
- Aug 14, 2025
Malicious code in com.microsoft.mixedreality.worldlockingtools (npm)
- Aug 14, 2025
Malicious code in com.microsoft.mixedreality.worldlockingsamples (npm)
- Aug 14, 2025
Malicious code in com.microsoft.mixedreality.wlt.asa.samples (npm)
- Aug 14, 2025
Malicious code in com.microsoft.mixedreality.wlt.asa (npm)
- Aug 14, 2025
Malicious code in com.microsoft.mixedreality.webrtc.samples (npm)
- Aug 14, 2025
Malicious code in com.microsoft.mixedreality.webrtc (npm)
- Aug 14, 2025
Malicious code in com.microsoft.mixedreality.toolkit.testutilities (npm)
- Aug 14, 2025
Malicious code in com.microsoft.mixedreality.toolkit.standardassets (npm)
- Aug 14, 2025
Malicious code in com.microsoft.mixedreality.toolkit.planefinding (npm)
- Aug 14, 2025
Malicious code in com.microsoft.mixedreality.toolkit.micstream (npm)
- Aug 14, 2025
Malicious code in com.microsoft.mixedreality.toolkit.gpustats (npm)
- Aug 14, 2025
Malicious code in com.microsoft.mixedreality.toolkit.figmabridge (npm)
- Aug 14, 2025
Malicious code in com.microsoft.mixedreality.toolkit.extensions (npm)
- Aug 14, 2025
Malicious code in com.microsoft.mixedreality.toolkit.examples (npm)
- Aug 14, 2025
Malicious code in com.microsoft.mixedreality.sceneunderstanding (npm)
- Aug 14, 2025
Malicious code in com.microsoft.mixedreality.powerthermalnotification (npm)
- Aug 14, 2025
Malicious code in com.microsoft.mixedreality.openxr (npm)
- Aug 14, 2025
Malicious code in com.microsoft.mixedreality.movingplatform (npm)
- Aug 14, 2025
Malicious code in com.microsoft.mixedreality.input (npm)
- Aug 14, 2025
Malicious code in com.microsoft.azure.spatial-anchors-sdk.windows (npm)
- Aug 14, 2025
Malicious code in com.microsoft.azure.spatial-anchors-sdk.ios (npm)
- Aug 14, 2025
Malicious code in com.microsoft.azure.spatial-anchors-sdk.core (npm)
- Aug 14, 2025
Malicious code in com.microsoft.azure.spatial-anchors-sdk.android (npm)
- Aug 14, 2025
Malicious code in com.microsoft.azure.remote-rendering (npm)
- Aug 14, 2025
Malicious code in com.microsoft.azure.object-anchors.runtime (npm)
- Aug 14, 2025
Malicious code in com.microsoft.altspacevr_uploader (npm)
- Aug 14, 2025
Malicious code in com.magicleap.unityaudiotools (npm)
- Aug 14, 2025
Malicious code in com.google.android.appbundle (npm)
- Aug 14, 2025
Malicious code in com.digmap.voicerecog (npm)
- Aug 14, 2025
Malicious code in com.carriersedge.zonarsinglesignon (npm)
- Aug 14, 2025
Malicious code in com.appsflyer.app.letscook (npm)
- Aug 14, 2025
Malicious code in com.apple.unityplugin.phase (npm)
- Aug 14, 2025
Malicious code in com.apple.unityplugin.gamekit (npm)
- Aug 14, 2025
Malicious code in com.apple.unityplugin.gamecontroller (npm)
- Aug 14, 2025
Malicious code in com.apple.unityplugin.corehaptics (npm)
- Aug 14, 2025
Malicious code in com.apple.unityplugin.core (npm)
- Aug 14, 2025
Malicious code in com.apple.unityplugin.arcade.splashscreen (npm)
Page 6074 of 7,293