Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,293 total in npm · sorted newest first- Mar 18, 2026
Malicious code in libjs-cqs (npm)
1 compromised version
- Mar 18, 2026
Malicious code in let1x5 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in legacy-shared-frontend (npm)
1 compromised version
- Mar 18, 2026
Malicious code in kmnb (npm)
1 compromised version
- Mar 18, 2026
Malicious code in kkkaremnnn (npm)
1 compromised version
- Mar 18, 2026
Malicious code in kkkaremnn (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in kkkaremm (npm)
1 compromised version
- Mar 18, 2026
Malicious code in karemzz (npm)
1 compromised version
- Mar 18, 2026
Malicious code in karemm4 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in karem9 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in karem3 (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in karem2 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in jwtenv (npm)
1 compromised version
- Mar 18, 2026
Malicious code in jsondatahandle (npm)
1 compromised version
- Mar 18, 2026
Malicious code in js-to-solve (npm)
1 compromised version
- Mar 18, 2026
Malicious code in iron-demo-helpers (npm)
1 compromised version
- Mar 18, 2026
Malicious code in ipherr (npm)
1 compromised version
- Mar 18, 2026
Malicious code in internal-secret-project-1234 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in internal-api-insights (npm)
1 compromised version
- Mar 18, 2026
Malicious code in inter-site-components (npm)
1 compromised version
- Mar 18, 2026
Malicious code in integration-icons (npm)
1 compromised version
- Mar 18, 2026
Malicious code in initial-path32 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in initial-path21 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in iconicwp-website (npm)
1 compromised version
- Mar 18, 2026
Malicious code in hydra-node-consent-sdk (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in hydra-consent-sdk (npm)
1 compromised version
- Mar 18, 2026
Malicious code in house-click (npm)
1 compromised version
- Mar 18, 2026
Malicious code in haodesk-ui (npm)
1 compromised version
- Mar 18, 2026
Malicious code in google-audit-tool (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in frontastic (npm)
1 compromised version
- Mar 18, 2026
Malicious code in fixerpabo_jkbts (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in fhgfhgfhfghhffhfgh (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in fe-prop-types (npm)
3 compromised versions
- Mar 18, 2026
Malicious code in fe-lib-theme (npm)
3 compromised versions
- Mar 18, 2026
Malicious code in fe-lib-singleton (npm)
3 compromised versions
- Mar 18, 2026
Malicious code in fe-lib-sequences (npm)
3 compromised versions
- Mar 18, 2026
Malicious code in fdir3 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in express-security-suite-2024 (npm)
3 compromised versions
- Mar 18, 2026
Malicious code in express-ranges (npm)
1 compromised version
- Mar 18, 2026
Malicious code in express-http-validator (npm)
4 compromised versions
- Mar 18, 2026
Malicious code in express-configers (npm)
1 compromised version
- Mar 18, 2026
Malicious code in eslint-plugin-superhuman-custom-rules (npm)
1 compromised version
- Mar 18, 2026
Malicious code in escaux (npm)
1 compromised version
- Mar 18, 2026
Malicious code in es1int-configer (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in ersagent-frontend (npm)
1 compromised version
- Mar 18, 2026
Malicious code in env-workflow-test (npm)
19 compromised versions
- Mar 18, 2026
Malicious code in engineers (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in elf-stats-velvet-ledger-928 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in ehance-assistant33 (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in ehance-assistant (npm)
2 compromised versions
Page 152 of 4,806