Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,322 total in npm · sorted newest first- Aug 14, 2025
Malicious code in zucchini-honeydew-nqnk (npm)
- Aug 14, 2025
Malicious code in zucchini-gorilla-hpot (npm)
- Aug 14, 2025
Malicious code in zucchini-golf-ewwm (npm)
- Aug 14, 2025
Malicious code in zucchini-foxtrot-yam-jckve (npm)
- Aug 14, 2025
Malicious code in zucchini-elderberry-rmku (npm)
- Aug 14, 2025
Malicious code in zucchini-charlie-qgiw (npm)
- Aug 14, 2025
Malicious code in zucchini-bw2-project (npm)
- Aug 14, 2025
Malicious code in zucchini-btw-project (npm)
- Aug 14, 2025
Malicious code in zucchini-bravo-peaj (npm)
- Aug 14, 2025
Malicious code in zucchini-blk-project (npm)
- Aug 14, 2025
Malicious code in zucchini-banana-lspj (npm)
- Aug 14, 2025
Malicious code in zucchini-axi-project (npm)
- Aug 14, 2025
Malicious code in zucchini-apple-orange-bqpzs (npm)
- Aug 14, 2025
Malicious code in zucchini-alpha-jyld (npm)
- Aug 14, 2025
Malicious code in zucchini-5lf-project (npm)
- Aug 14, 2025
Malicious code in zucchini-0q1-project (npm)
- Aug 14, 2025
Malicious code in zucchini-0py-project (npm)
- Aug 14, 2025
Malicious code in ztxt47 (npm)
- Aug 14, 2025
Malicious code in ztreedev (npm)
- Aug 14, 2025
Malicious code in ztqbirsmukyvklce (npm)
- Aug 14, 2025
Malicious code in ztouch (npm)
- Aug 14, 2025
Malicious code in zteuifglpqjrmnyk (npm)
- Aug 14, 2025
Malicious code in zsyirwqjgxeopbhc (npm)
- Aug 14, 2025
Malicious code in zsunjxagfchbeiwr (npm)
- Aug 14, 2025
Malicious code in zstuxvyckfndwaop (npm)
- Aug 14, 2025
Malicious code in zstudio (npm)
- Aug 14, 2025
Malicious code in zspider (npm)
- Aug 14, 2025
Malicious code in zsnout (npm)
- Aug 14, 2025
Malicious code in zsnapmgr (npm)
- Aug 14, 2025
Malicious code in zsjrepo (npm)
- Aug 14, 2025
Malicious code in zsihdpqngexlfovw (npm)
- Aug 14, 2025
Malicious code in zs-sha3 (npm)
- Aug 14, 2025
Malicious code in zrnowkqmypfcktgs (npm)
- Aug 14, 2025
Malicious code in zrfinjygoeabdvqx (npm)
- Aug 14, 2025
Malicious code in zqxiorpluetacjws (npm)
- Aug 14, 2025
Malicious code in zqjncipomtlkvghk (npm)
- Aug 14, 2025
Malicious code in zpulse (npm)
- Aug 14, 2025
Malicious code in zprklugbxcivahwo (npm)
- Aug 14, 2025
Malicious code in zpoepg (npm)
- Aug 14, 2025
Malicious code in zpmucxkiysjegola (npm)
- Aug 14, 2025
Malicious code in zpgp (npm)
- Aug 14, 2025
Malicious code in zounds (npm)
- Aug 14, 2025
Malicious code in zosntewxubykrgfh (npm)
- Aug 14, 2025
Malicious code in zorya-web-client (npm)
- Aug 14, 2025
Malicious code in zooplus-react-starter (npm)
- Aug 14, 2025
Malicious code in zoopark (npm)
- Aug 14, 2025
Malicious code in zoomdata-spa-samplemodule (npm)
- Aug 14, 2025
Malicious code in zoomdata-spa-core (npm)
- Aug 14, 2025
Malicious code in zoomdata-core (npm)
- Aug 14, 2025
Malicious code in zoom-app-workshop (npm)
Page 5202 of 6,667