Malicious package index — page 1 of 36

Every malicious-package advisory O3 Security publishes, listed so each one is reachable in a few clicks. 7,137 packages across 36 pages.

• npm/@regex33-hackerone/tb-compat
• npm/@s4yhiitestpoc/r2-control
• npm/@s4yhiitestpoc/r2-dns
• npm/@s4yhiitestpoc/r2-echo
• npm/@s4yhiitestpoc/r2-https-b
• npm/@s4yhiitestpoc/r2-https-dualuse
• npm/@s4yhiitestpoc/scan-control-a
• npm/@s4yhiitestpoc/scan-dns-c
• npm/@s4yhiitestpoc/scan-echo-b
• npm/@s4yhiitestpoc/scan-https-d
• npm/@s4yhiitestpoc/scan-https-dualuse-e
• npm/ap3-foundations-ui
• npm/bow-test
• npm/brass-common
• npm/css-flexgap-shim
• npm/css-grid-snap-util
• npm/css-hnhxwd-polyfill
• npm/css-overscroll-contain
• npm/dsh-native
• npm/monitoring-agent
• npm/orderly-plugin-liquidity-heatmap
• npm/react-dropzone-v4
• npm/util-foriepft
• pypi/claudeopusfile
• pypi/dictmerge-lite
• npm/@blueskydataplatform/shared-ui
• npm/@capsense/ccx-welcome-page
• npm/@capsense/core-ui
• npm/@cecm-web-sdk/core
• npm/@drone-js-ext/core
• npm/@drone-js-ext/vip-badge
• npm/@eforms/forms-api
• npm/@factiii/runner
• npm/@factoryz/apollo
• npm/@fcsmc/commercial-analytics
• npm/@fmr-ap149494/apex-base-component
• npm/@fmr-ap153177/apex-kit-icons
• npm/@futurae-public/adaptive-js
• npm/@generic-means/ing-feat-scanner-libs
• npm/@greenlake/common-context
• npm/@greenlake/session
• npm/@jm-telefonica/multibrand-components
• npm/@postex/common
• npm/@ppa-web-components/ppa-banner
• npm/@ppa-web-components/ppa-builder
• npm/@ppa-web-components/ppa-headerfooter
• npm/@ppa-web-components/ppa-hotel-collection
• npm/@ppa-web-components/ppa-navigation
• npm/@ppa-web-components/ppa-searchform
• npm/appit-cordova-admob
• npm/appit-cordova-plugin-ionic
• npm/ccl-global-shopping
• npm/cert-infos
• npm/cordova-plugin-geofence-appit
• npm/event-bus-lite-testmetest
• npm/ing-feat-itsme-oidc-authentication
• npm/insta-api-wrapper
• npm/insta-reel-search
• npm/ionic-insta-api-wrapper
• npm/ionic-insta-search
• npm/ionic-sound-cloud-loader-api
• npm/ionic-tiktok-scraper
• npm/ionic-youtube-search
• npm/ionic-youtube-streams
• npm/jshelperdependenceny
• npm/ocsp-hashes
• npm/p12-pem
• npm/paychex-pdftron
• npm/react-native-bright-sdk
• npm/redis-dumper
• npm/sc-announcer
• npm/sc-font-icons
• npm/sc-geeksquad-core
• npm/sc-hydrate-carousel-price
• npm/sc-wizard
• npm/sound-cloud-loader-api
• npm/tailwind-base-buttons
• npm/tiktok-video-scraper
• npm/tostpro
• npm/w-mousekey
• npm/youtube-info-streams
• npm/youtube-search-without-api-key
• pypi/aseity
• pypi/aseitylab
• pypi/claudedashbord
• pypi/claudeopuseni
• pypi/claudeopusenifile
• pypi/coinscan
• pypi/donutautosellsrc
• pypi/donutpromotion
• pypi/fontus
• pypi/nebulallm
• pypi/zagents-message-bus
• npm/@k18k/entrypoint-sdk-darwin-arm64
• npm/@liauto/win32-x64
• npm/noelc-css-blender
• npm/overarch-windows-x64-yr
• npm/tailwindcss-theme-kit
• npm/@ecg-internal/adobe-dmp-js
• npm/@ecg-internal/aurora-js-formatters
• npm/@ecg-internal/favourites-ui
• npm/@ecg-internal/js-react-i18n
• npm/@ecg-internal/media-util-js-lib
• npm/@ecg-internal/reviews-dialog-ui
• npm/@grabcad/company-server-shared
• npm/@grabcad/grabcad-shop-shared
• npm/@grabcad/preferences-client
• npm/@grabcad/user-license
• npm/@k18k/entrypoint-sdk-darwin-x64
• npm/@k18k/entrypoint-sdk-linux-x64
• npm/@kibt/www-nuxt-i18n
• npm/@tekmidian/pai
• npm/imgdecode
• npm/orqiva-runtime-win32-x64
• npm/skillward
• pypi/badgertask
• pypi/brambletask
• pypi/brookworker
• pypi/cobbleload
• pypi/ferretqueue
• pypi/flintqueue
• pypi/jobwharf
• pypi/juniperrun
• pypi/kestreljob
• pypi/larchworker
• pypi/loadferry
• pypi/marshrunner
• pypi/onsokets
• pypi/otterload
• pypi/qowa
• pypi/reedworker
• pypi/runpier
• pypi/sedgehaul
• pypi/sitecard
• pypi/slatejob
• pypi/taskquay
• pypi/thistlerun
• pypi/thornqueue
• pypi/workslip
• npm/@conduitops/logview-archive
• npm/@decoopus/claude-setup
• npm/@liauto/darwin-x64
• npm/@lumen-labs-dev/whisper-node
• npm/@pkgship/frpc-darwin-amd64
• npm/@pkgship/frpc-linux-amd64
• npm/@pkgship/frps-linux-amd64
• npm/@platform-services/hrm-mfe-core
• npm/@seggy116/next-diff
• npm/@sudobility/indexer_client
• npm/@sudobility/shaperouter_client
• npm/@sudobility/testomniac_client
• npm/@sudobility/wildduck_client
• npm/agentic-awesome-skills
• npm/darknode-cli
• npm/data-pipeline-testmetest
• npm/event-emitter-testmetest
• npm/fanarena-common
• npm/formatting-subtitles
• npm/kvarzo8f3atestmetest
• npm/log-rotate-testmetest
• npm/log-sink-testmetest
• npm/net-codec-testmetest
• npm/opencode-skills-collection
• npm/pixel-map-testmetest
• npm/sdk-utils-testmetest
• npm/simplewave
• npm/test-brotli-testmetest
• npm/test-brotli2-testmetest
• npm/unicode-title-normalizer
• npm/x402-prompt-injection-scan
• pypi/1h1
• pypi/aanthropic
• pypi/acoustichub
• pypi/acousticpack
• pypi/asrdock
• pypi/asrloom
• pypi/audiokit
• pypi/aurenatts
• pypi/batchspar
• pypi/benchbridge
• pypi/benchworks
• pypi/brummatts
• pypi/codecraze
• pypi/crenelatts
• pypi/debbug
• pypi/deebug
• pypi/dictanovaasr
• pypi/evalstream
• pypi/facewareretargeter
• pypi/grommatts
• pypi/hookgantry
• pypi/journey-teste-shellhello
• pypi/melcuratts
• pypi/modelworks
• pypi/orchestril
• pypi/phonemeforge
• pypi/phonemeprobe
• pypi/phonoviatts
• pypi/pipegrip
• pypi/prosodinetts