Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Aug 14, 2025
Malicious code in blossom-kiwi-wrc666-project (npm)
- Aug 14, 2025
Malicious code in blossom-kiwi-sli430-project (npm)
- Aug 14, 2025
Malicious code in blossom-jellyfish-qij313-project (npm)
- Aug 14, 2025
Malicious code in blossom-hedgehog-lyc455-project (npm)
- Aug 14, 2025
Malicious code in blossom-desert-ckg410-project (npm)
- Aug 14, 2025
Malicious code in blossom-6irbq-xky0r-crescent-project (npm)
- Aug 14, 2025
Malicious code in blossom-3yjfq-apy5h-quasar-project (npm)
- Aug 14, 2025
Malicious code in bloomr (npm)
- Aug 14, 2025
Malicious code in bloom_v4crt_u2uue_solstice (npm)
- Aug 14, 2025
Malicious code in bloom_oovu9_v4drv_karma (npm)
- Aug 14, 2025
Malicious code in bloom_nqdkl_h0tfq_xylophone (npm)
- Aug 14, 2025
Malicious code in bloom_ih7qq_k3iej_kale (npm)
- Aug 14, 2025
Malicious code in bloom_95v7z_ewa3h_elephant (npm)
- Aug 14, 2025
Malicious code in bloom_7gr9h_jokyj_flare (npm)
- Aug 14, 2025
Malicious code in bloom_78bzk_aymzu_pine (npm)
- Aug 14, 2025
Malicious code in bloom-web (npm)
- Aug 14, 2025
Malicious code in bloom-lang (npm)
- Aug 14, 2025
Malicious code in blogyanis (npm)
- Aug 14, 2025
Malicious code in blogspine (npm)
- Aug 14, 2025
Malicious code in blogpcs (npm)
- Aug 14, 2025
Malicious code in bloging (npm)
- Aug 14, 2025
Malicious code in blogiest (npm)
- Aug 14, 2025
Malicious code in bloggap (npm)
- Aug 14, 2025
Malicious code in blog-post-prisma-middleware-cls-hooked (npm)
- Aug 14, 2025
Malicious code in bloemberg (npm)
- Aug 14, 2025
Malicious code in blockurl (npm)
- Aug 14, 2025
Malicious code in blocksqt (npm)
- Aug 14, 2025
Malicious code in blockplus (npm)
- Aug 14, 2025
Malicious code in blockly-test (npm)
- Aug 14, 2025
Malicious code in blockheads (npm)
- Aug 14, 2025
Malicious code in blockchain-components (npm)
- Aug 14, 2025
Malicious code in blockblog (npm)
- Aug 14, 2025
Malicious code in block-pattern-explorer (npm)
- Aug 14, 2025
Malicious code in block-chain (npm)
- Aug 14, 2025
Malicious code in bloccit (npm)
- Aug 14, 2025
Malicious code in blobico (npm)
- Aug 14, 2025
Malicious code in blkargufqimctnwy (npm)
- Aug 14, 2025
Malicious code in blitz-stream-convict-webdriverio (npm)
- Aug 14, 2025
Malicious code in blitz-standard-mongoose-astrobiology (npm)
- Aug 14, 2025
Malicious code in blitz-colors-abiogenesis-augmentedreality (npm)
- Aug 14, 2025
Malicious code in bliss-ivory-ene692-project (npm)
- Aug 14, 2025
Malicious code in blippress (npm)
- Aug 14, 2025
Malicious code in blipbot (npm)
- Aug 14, 2025
Malicious code in blimps (npm)
- Aug 14, 2025
Malicious code in blendish (npm)
- Aug 14, 2025
Malicious code in blending (npm)
- Aug 14, 2025
Malicious code in blaze-ui-components-site (npm)
- Aug 14, 2025
Malicious code in blaze-release-it-morgan-biosignature (npm)
- Aug 14, 2025
Malicious code in blaze-quantumfoam-nconf-global (npm)
- Aug 14, 2025
Malicious code in blaze-optimize-css-assets-webpack-plugin-cosmogenic-joviology (npm)
Page 6104 of 7,293