Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,355 total in npm · sorted newest first- Aug 14, 2025
Malicious code in @leaffm/leaf-connect (npm)
- Aug 14, 2025
Malicious code in @leaffm/components (npm)
- Aug 14, 2025
Malicious code in @leaffm/automatically-gen-script (npm)
- Aug 14, 2025
Malicious code in @leaffm/automatic-script-test (npm)
- Aug 14, 2025
Malicious code in @lbnqduy2180500/silver-octo-pancake (npm)
- Aug 14, 2025
Malicious code in @lbnqduy1/upgraded-carnival (npm)
- Aug 14, 2025
Malicious code in @lbnqduy1/refactored-waffle (npm)
- Aug 14, 2025
Malicious code in @lbnqduy1/refactored-happiness (npm)
- Aug 14, 2025
Malicious code in @lbnqduy1/ideal-octo-garbanzo (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/vigilant-spoon (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/urban-waddle (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/urban-palm-tree (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/ubiquitous-lamp (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/turbo-chainsaw (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/supreme-octo-waffle (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/super-octo-eureka (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/super-bassoon (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/sturdy-octo-potato (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/sturdy-garbanzo (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/stunning-waffle (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/stunning-rotary-phone (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/special-barnacle (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/solid-robot (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/solid-funicular (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/reimagined-octo-disco (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/refactored-fiesta (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/redesigned-tribble (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/redesigned-barnacle (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/psychic-octo-system (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/psychic-journey (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/potential-succotash (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/potential-parakeet (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/potential-memory (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/potential-eureka (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/musical-octo-succotash (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/musical-computing-machine (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/legendary-journey (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/laughing-journey (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/improved-chainsaw (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/fluffy-meme (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/fictional-goggles (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/fantastic-doodle (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/effective-system (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/didactic-waffle (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/didactic-disco (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/curly-octo-rotary-phone (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/congenial-waffle (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/congenial-tribble (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/congenial-octo-sniffle (npm)
- Aug 14, 2025
Malicious code in @lbnqduy/cautious-happiness (npm)
Page 5172 of 6,668