Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Aug 14, 2025
Malicious code in cherry-delta-catv (npm)
- Aug 14, 2025
Malicious code in cherry-ck1-project (npm)
- Aug 14, 2025
Malicious code in cherry-charlie-boru (npm)
- Aug 14, 2025
Malicious code in cherry-ch2-project (npm)
- Aug 14, 2025
Malicious code in cherry-car-nnik (npm)
- Aug 14, 2025
Malicious code in cherry-bravo-ywoa (npm)
- Aug 14, 2025
Malicious code in cherry-bravo-delta-vgwgv (npm)
- Aug 14, 2025
Malicious code in cherry-banana-qeah (npm)
- Aug 14, 2025
Malicious code in cherry-albatross-ffg010-project (npm)
- Aug 14, 2025
Malicious code in cherry-ad8-project (npm)
- Aug 14, 2025
Malicious code in cherry-5xa-project (npm)
- Aug 14, 2025
Malicious code in cherry-587-project (npm)
- Aug 14, 2025
Malicious code in cherry-4t3-project (npm)
- Aug 14, 2025
Malicious code in cherry-3o3-project (npm)
- Aug 14, 2025
Malicious code in cherry-0kk-project (npm)
- Aug 14, 2025
Malicious code in chenlizan_test (npm)
- Aug 14, 2025
Malicious code in chemeria (npm)
- Aug 14, 2025
Malicious code in chefsnapp (npm)
- Aug 14, 2025
Malicious code in chefkt (npm)
- Aug 14, 2025
Malicious code in cheesewiz (npm)
- Aug 14, 2025
Malicious code in cheerio-ajax (npm)
- Aug 14, 2025
Malicious code in cheditor (npm)
- Aug 14, 2025
Malicious code in checksum-validator (npm)
- Aug 14, 2025
Malicious code in checks-mix (npm)
- Aug 14, 2025
Malicious code in checkout_queue (npm)
- Aug 14, 2025
Malicious code in checkout-web (npm)
- Aug 14, 2025
Malicious code in checkout-success-fragment (npm)
- Aug 14, 2025
Malicious code in checkout-automated-tests (npm)
- Aug 14, 2025
Malicious code in checkit-backend (npm)
- Aug 14, 2025
Malicious code in checkfor (npm)
- Aug 14, 2025
Malicious code in checkdig (npm)
- Aug 14, 2025
Malicious code in check-type-array (npm)
- Aug 14, 2025
Malicious code in check-readstream-really-awesome-totally-secure-i-think (npm)
- Aug 14, 2025
Malicious code in check-readstream (npm)
- Aug 14, 2025
Malicious code in check-google-play-card-balance127 (npm)
- Aug 14, 2025
Malicious code in check-google-play-card-balance031 (npm)
- Aug 14, 2025
Malicious code in cheatmod (npm)
- Aug 14, 2025
Malicious code in cheaters (npm)
- Aug 14, 2025
Malicious code in che-theia-ssh-extension (npm)
- Aug 14, 2025
Malicious code in che-theia-activity-tracker (npm)
- Aug 14, 2025
Malicious code in chazer (npm)
- Aug 14, 2025
Malicious code in chavvelo (npm)
- Aug 14, 2025
Malicious code in chaunter (npm)
- Aug 14, 2025
Malicious code in chatvader (npm)
- Aug 14, 2025
Malicious code in chatscala (npm)
- Aug 14, 2025
Malicious code in chatruby (npm)
- Aug 14, 2025
Malicious code in chatham (npm)
- Aug 14, 2025
Malicious code in chatgroup (npm)
- Aug 14, 2025
Malicious code in chatarum (npm)
- Aug 14, 2025
Malicious code in chat-api2 (npm)
Page 6083 of 7,293