Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in kale-ocean-qah232-project (npm)
- Aug 14, 2025
Malicious code in kale-ll0bm-ehsrg-horizon-project (npm)
- Aug 14, 2025
Malicious code in kale-jetty-sz12 (npm)
- Aug 14, 2025
Malicious code in kale-jacket-cqr350-project (npm)
- Aug 14, 2025
Malicious code in kale-hazel-bkno (npm)
- Aug 14, 2025
Malicious code in kale-gxbmo-xx6ds-fjord-project (npm)
- Aug 14, 2025
Malicious code in kale-dock-e3yd (npm)
- Aug 14, 2025
Malicious code in kale-albatross-crn680-project (npm)
- Aug 14, 2025
Malicious code in kale-9xedz-4lgzx-unity-project (npm)
- Aug 14, 2025
Malicious code in kakurea (npm)
- Aug 14, 2025
Malicious code in kakfa-service-interface-sample (npm)
- Aug 14, 2025
Malicious code in kajgps (npm)
- Aug 14, 2025
Malicious code in kaiyu-webdatarocks (npm)
- Aug 14, 2025
Malicious code in kahanmpi (npm)
- Aug 14, 2025
Malicious code in kafka-shopify (npm)
- Aug 14, 2025
Malicious code in kafka-client-ruby (npm)
- Aug 14, 2025
Malicious code in kaerwzyhlkngvxic (npm)
- Aug 14, 2025
Malicious code in kadummy (npm)
- Aug 14, 2025
Malicious code in kachbis (npm)
- Aug 14, 2025
Malicious code in kabusaku (npm)
- Aug 14, 2025
Malicious code in kaascript (npm)
- Aug 14, 2025
Malicious code in kaargo (npm)
- Aug 14, 2025
Malicious code in k8s_ci (npm)
- Aug 14, 2025
Malicious code in k8s-template-validator (npm)
- Aug 14, 2025
Malicious code in k8s-ssdeployer (npm)
- Aug 14, 2025
Malicious code in k8s-image-extractor (npm)
- Aug 14, 2025
Malicious code in k3npj1 (npm)
- Aug 14, 2025
Malicious code in k0a_multer (npm)
- Aug 14, 2025
Malicious code in jzltdokrbsnxpvmi (npm)
- Aug 14, 2025
Malicious code in jyuaxotnvldismzc (npm)
- Aug 14, 2025
Malicious code in jylcutigknzmdbhf (npm)
- Aug 14, 2025
Malicious code in jyhmpldxkbvgruia (npm)
- Aug 14, 2025
Malicious code in jygsaw (npm)
- Aug 14, 2025
Malicious code in jyblog (npm)
- Aug 14, 2025
Malicious code in jwt-webpack-procyon-thuban (npm)
- Aug 14, 2025
Malicious code in jwt-toml-leda-despina (npm)
- Aug 14, 2025
Malicious code in jwt-technocracy-envconfig-venus (npm)
- Aug 14, 2025
Malicious code in jwt-on-superagent-ora (npm)
- Aug 14, 2025
Malicious code in jwt-mongodb-nestjs-gacrux (npm)
- Aug 14, 2025
Malicious code in jwt-module-pipe-chalk (npm)
- Aug 14, 2025
Malicious code in jwt-convict-dependencies-resolvers (npm)
- Aug 14, 2025
Malicious code in jwt-andromeda-eridanus-bellatrix (npm)
- Aug 14, 2025
Malicious code in jwnkqtsfmkbxvrge (npm)
- Aug 14, 2025
Malicious code in jwaves (npm)
- Aug 14, 2025
Malicious code in jw2s1s (npm)
- Aug 14, 2025
Malicious code in jw-sha3 (npm)
- Aug 14, 2025
Malicious code in jvxizlbedrwafkos (npm)
- Aug 14, 2025
Malicious code in jvkwhguyilsdpntq (npm)
- Aug 14, 2025
Malicious code in juvoft (npm)
- Aug 14, 2025
Malicious code in justtestasa (npm)
Page 5508 of 6,634