Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in jsplc-date (npm)
- Aug 14, 2025
Malicious code in jspeel (npm)
- Aug 14, 2025
Malicious code in jsonweqjoken (npm)
6 compromised versions
- Aug 14, 2025
Malicious code in jsontome (npm)
- Aug 14, 2025
Malicious code in jsonp-testcafe-aether-blazar (npm)
- Aug 14, 2025
Malicious code in jsonp-reveal-md-rollup-plugin-envconfig (npm)
- Aug 14, 2025
Malicious code in jsonp-neptune-neptune-zephyr (npm)
- Aug 14, 2025
Malicious code in jsonp-init-command-bunyan (npm)
- Aug 14, 2025
Malicious code in jsonp-envconfig-betelgeuse-eslint (npm)
- Aug 14, 2025
Malicious code in jsonlift (npm)
- Aug 14, 2025
Malicious code in jsonl10nfilecomparer (npm)
- Aug 14, 2025
Malicious code in jsoncake (npm)
- Aug 14, 2025
Malicious code in jsonbind (npm)
- Aug 14, 2025
Malicious code in json_log_formatter (npm)
- Aug 14, 2025
Malicious code in json9 (npm)
- Aug 14, 2025
Malicious code in json-soap-postcss-tectonic (npm)
- Aug 14, 2025
Malicious code in json-search (npm)
- Aug 14, 2025
Malicious code in json-resources (npm)
- Aug 14, 2025
Malicious code in json-perseus-package-ursa (npm)
- Aug 14, 2025
Malicious code in json-packet-parser (npm)
- Aug 14, 2025
Malicious code in json-language-server (npm)
- Aug 14, 2025
Malicious code in json-juno-pegasus-ursa (npm)
- Aug 14, 2025
Malicious code in json-configs (npm)
- Aug 14, 2025
Malicious code in jsmsha3 (npm)
- Aug 14, 2025
Malicious code in jsii-calc (npm)
- Aug 14, 2025
Malicious code in jsii-build-tools (npm)
- Aug 14, 2025
Malicious code in jsify (npm)
- Aug 14, 2025
Malicious code in jshydra (npm)
- Aug 14, 2025
Malicious code in jshkrnxbylzdpfqi (npm)
- Aug 14, 2025
Malicious code in jshdate (npm)
- Aug 14, 2025
Malicious code in jshashset (npm)
- Aug 14, 2025
Malicious code in jscourse (npm)
- Aug 14, 2025
Malicious code in jscarton (npm)
- Aug 14, 2025
Malicious code in js3030-week4 (npm)
- Aug 14, 2025
Malicious code in js3030-week3 (npm)
- Aug 14, 2025
Malicious code in js3030-week2 (npm)
- Aug 14, 2025
Malicious code in js3030-week1 (npm)
- Aug 14, 2025
Malicious code in js3030-main (npm)
- Aug 14, 2025
Malicious code in js3030-installation (npm)
- Aug 14, 2025
Malicious code in js-wha3 (npm)
- Aug 14, 2025
Malicious code in js-task-paths (npm)
- Aug 14, 2025
Malicious code in js-sxa3 (npm)
- Aug 14, 2025
Malicious code in js-sla3 (npm)
- Aug 14, 2025
Malicious code in js-sja3 (npm)
- Aug 14, 2025
Malicious code in js-sia3 (npm)
- Aug 14, 2025
Malicious code in js-shq3 (npm)
- Aug 14, 2025
Malicious code in js-shi3 (npm)
- Aug 14, 2025
Malicious code in js-she3 (npm)
- Aug 14, 2025
Malicious code in js-shc3 (npm)
- Aug 14, 2025
Malicious code in js-shas (npm)
Page 5512 of 6,634