Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in log4js-vue-log-bus (npm)
- Aug 14, 2025
Malicious code in log-zeta-resolve-index-module (npm)
- Aug 14, 2025
Malicious code in log-symboles (npm)
- Aug 14, 2025
Malicious code in log-rendering-error (npm)
- Aug 14, 2025
Malicious code in log-final-public-upsilon-virtualize (npm)
- Aug 14, 2025
Malicious code in loftre (npm)
- Aug 14, 2025
Malicious code in lodstats (npm)
- Aug 14, 2025
Malicious code in lodsah (npm)
- Aug 14, 2025
Malicious code in lodqwh (npm)
- Aug 14, 2025
Malicious code in lodqsh (npm)
- Aug 14, 2025
Malicious code in lodownryanhanks1106 (npm)
- Aug 14, 2025
Malicious code in lodown-samsung329 (npm)
- Aug 14, 2025
Malicious code in lodassh (npm)
- Aug 14, 2025
Malicious code in lodasn (npm)
- Aug 14, 2025
Malicious code in lodashn (npm)
- Aug 14, 2025
Malicious code in lodashh (npm)
- Aug 14, 2025
Malicious code in lodash_tailwind (npm)
- Aug 14, 2025
Malicious code in lodash.js (npm)
- Aug 14, 2025
Malicious code in lodash-simple (npm)
- Aug 14, 2025
Malicious code in lodash-g (npm)
- Aug 14, 2025
Malicious code in lodash-fast (npm)
- Aug 14, 2025
Malicious code in lodahs (npm)
- Aug 14, 2025
Malicious code in lodah (npm)
- Aug 14, 2025
Malicious code in lodache (npm)
- Aug 14, 2025
Malicious code in locoquizz (npm)
- Aug 14, 2025
Malicious code in loclys-leaflet-routing-machine (npm)
- Aug 14, 2025
Malicious code in locktools (npm)
- Aug 14, 2025
Malicious code in lockheed-react (npm)
- Aug 14, 2025
Malicious code in locker-client-js-manifest (npm)
- Aug 14, 2025
Malicious code in lock-test6035 (npm)
- Aug 14, 2025
Malicious code in locits (npm)
- Aug 14, 2025
Malicious code in locationary (npm)
- Aug 14, 2025
Malicious code in localz-react-native-sdk (npm)
- Aug 14, 2025
Malicious code in localz-lastmile-ui-login (npm)
- Aug 14, 2025
Malicious code in localz-lastmile-react-native-sdk (npm)
- Aug 14, 2025
Malicious code in locale-dev-cdbs (npm)
- Aug 14, 2025
Malicious code in local-terser-wasat-ophiuchus (npm)
- Aug 14, 2025
Malicious code in local-storage-manager-html5 (npm)
- Aug 14, 2025
Malicious code in local-quantumfoam-cypress-cosmology (npm)
- Aug 14, 2025
Malicious code in local-phoebe-soap-react-bootstrap (npm)
- Aug 14, 2025
Malicious code in local-news-stream (npm)
- Aug 14, 2025
Malicious code in local-modules-as-global (npm)
- Aug 14, 2025
Malicious code in local-lds (npm)
- Aug 14, 2025
Malicious code in local-impulse-decoherence-stream (npm)
- Aug 14, 2025
Malicious code in local-dependency (npm)
- Aug 14, 2025
Malicious code in local-debug (npm)
- Aug 14, 2025
Malicious code in lobbying (npm)
- Aug 14, 2025
Malicious code in loan-match-list (npm)
- Aug 14, 2025
Malicious code in loadyaml (npm)
- Aug 14, 2025
Malicious code in loader-8319331108 (npm)
Page 5481 of 6,634