Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Aug 14, 2025
Malicious code in cm-algorithmjs (npm)
- Aug 14, 2025
Malicious code in clusterpoint-api-v4 (npm)
- Aug 14, 2025
Malicious code in cluster-xenobiology-inflation-mongodb (npm)
- Aug 14, 2025
Malicious code in cluster-transpile-java-simple-balance (npm)
- Aug 14, 2025
Malicious code in cluster-sudo-fast-info-iota (npm)
- Aug 14, 2025
Malicious code in cluster-registry (npm)
- Aug 14, 2025
Malicious code in cluster-publish-firebase-module (npm)
- Aug 14, 2025
Malicious code in cluster-petrology-thuban-protractor (npm)
- Aug 14, 2025
Malicious code in cluster-pegasus-cluster-geoarchaeology (npm)
- Aug 14, 2025
Malicious code in cluster-nextjs-html-webpack-plugin-scripts (npm)
- Aug 14, 2025
Malicious code in cluster-middleware-parcel-flare (npm)
- Aug 14, 2025
Malicious code in cluster-lithosphere-baryon-gammarayburst (npm)
- Aug 14, 2025
Malicious code in cluster-lightyear-grus-public (npm)
- Aug 14, 2025
Malicious code in cluster-entanglement-update-spectroscopy (npm)
- Aug 14, 2025
Malicious code in cluster-easy-sed-throw-cloud (npm)
- Aug 14, 2025
Malicious code in cluster-babel-apollo-cors (npm)
- Aug 14, 2025
Malicious code in cluster-avior-norma-gravity (npm)
- Aug 14, 2025
Malicious code in clupda (npm)
- Aug 14, 2025
Malicious code in clunit (npm)
- Aug 14, 2025
Malicious code in cluep-express-middleware (npm)
- Aug 14, 2025
Malicious code in clubapp (npm)
- Aug 14, 2025
Malicious code in clradio (npm)
- Aug 14, 2025
Malicious code in cloudwatch2slack (npm)
- Aug 14, 2025
Malicious code in CloudStore (npm)
- Aug 14, 2025
Malicious code in cloudmsc (npm)
- Aug 14, 2025
Malicious code in cloudlet (npm)
- Aug 14, 2025
Malicious code in cloudkid (npm)
- Aug 14, 2025
Malicious code in cloudipsp (npm)
- Aug 14, 2025
Malicious code in cloudinary-url-builder (npm)
- Aug 14, 2025
Malicious code in cloudflare_ruby (npm)
- Aug 14, 2025
Malicious code in cloudera-manager-client (npm)
- Aug 14, 2025
Malicious code in cloudcarl (npm)
- Aug 14, 2025
Malicious code in cloud_storage_utils (npm)
- Aug 14, 2025
Malicious code in cloud-zebra-xbd230-project (npm)
- Aug 14, 2025
Malicious code in cloud-yeti-dpf049-project (npm)
- Aug 14, 2025
Malicious code in cloud-yawn-xfs533-project (npm)
- Aug 14, 2025
Malicious code in cloud-umbra-tya835-project (npm)
- Aug 14, 2025
Malicious code in cloud-tulip-ivv088-project (npm)
- Aug 14, 2025
Malicious code in cloud-shell-getting-started (npm)
- Aug 14, 2025
Malicious code in cloud-shell-extension (npm)
- Aug 14, 2025
Malicious code in cloud-runtime-authorization (npm)
- Aug 14, 2025
Malicious code in cloud-runtime (npm)
- Aug 14, 2025
Malicious code in cloud-reef-efw601-project (npm)
- Aug 14, 2025
Malicious code in cloud-quasar-qmf033-project (npm)
- Aug 14, 2025
Malicious code in cloud-pi-signal-wind-enum (npm)
- Aug 14, 2025
Malicious code in cloud-opaline-bld350-project (npm)
- Aug 14, 2025
Malicious code in cloud-object-service (npm)
- Aug 14, 2025
Malicious code in cloud-object-new-resolve-grid (npm)
- Aug 14, 2025
Malicious code in cloud-lagoon-wgk918-project (npm)
- Aug 14, 2025
Malicious code in cloud-iota-table-pipe-catch (npm)
Page 6077 of 7,293