Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in jekyll-cypress-exobiology-miranda (npm)
- Aug 14, 2025
Malicious code in jekpress (npm)
- Aug 14, 2025
Malicious code in jefftrax (npm)
- Aug 14, 2025
Malicious code in jeetbad (npm)
- Aug 14, 2025
Malicious code in jedismash (npm)
- Aug 14, 2025
Malicious code in jdevice-nodejs-sdk (npm)
- Aug 14, 2025
Malicious code in jddfdsdmadgktestdjjtema (npm)
- Aug 14, 2025
Malicious code in jdctest (npm)
- Aug 14, 2025
Malicious code in jdcbrkytsvfimwhg (npm)
- Aug 14, 2025
Malicious code in jdb.js (npm)
- Aug 14, 2025
Malicious code in jd7x4x (npm)
- Aug 14, 2025
Malicious code in jcterm (npm)
- Aug 14, 2025
Malicious code in jcrmtvxbeksqdaiu (npm)
- Aug 14, 2025
Malicious code in jcqkdgtzykohwrun (npm)
- Aug 14, 2025
Malicious code in jcicorereturnservice (npm)
- Aug 14, 2025
Malicious code in jchatsock (npm)
- Aug 14, 2025
Malicious code in jcatalog-react-reference-search (npm)
- Aug 14, 2025
Malicious code in jcatalog-react-fixed-data-table (npm)
- Aug 14, 2025
Malicious code in jc-sha3 (npm)
- Aug 14, 2025
Malicious code in jbspacer (npm)
- Aug 14, 2025
Malicious code in jbsignal (npm)
- Aug 14, 2025
Malicious code in jblank (npm)
- Aug 14, 2025
Malicious code in jb-abtest (npm)
- Aug 14, 2025
Malicious code in jayparser (npm)
- Aug 14, 2025
Malicious code in jaynan (npm)
- Aug 14, 2025
Malicious code in jaydocs (npm)
- Aug 14, 2025
Malicious code in jayaff (npm)
- Aug 14, 2025
Malicious code in jaxproc (npm)
- Aug 14, 2025
Malicious code in jawema (npm)
- Aug 14, 2025
Malicious code in javauto (npm)
- Aug 14, 2025
Malicious code in javatres (npm)
- Aug 14, 2025
Malicious code in javastoreid (npm)
- Aug 14, 2025
Malicious code in javasite (npm)
- Aug 14, 2025
Malicious code in javashop (npm)
- Aug 14, 2025
Malicious code in javascript3030 (npm)
- Aug 14, 2025
Malicious code in javascript-xenos-rigel-izar (npm)
- Aug 14, 2025
Malicious code in javascript-radioastronomy-morgan-carina (npm)
- Aug 14, 2025
Malicious code in javascript-protoplanetarydisk-yakutsk-string (npm)
- Aug 14, 2025
Malicious code in javascript-package-kaus-xml (npm)
- Aug 14, 2025
Malicious code in javascript-outercore-scripts-gridsome (npm)
- Aug 14, 2025
Malicious code in javascript-nightmare-jekyll-postcss-loader (npm)
- Aug 14, 2025
Malicious code in javascript-msx-sdk (npm)
- Aug 14, 2025
Malicious code in javascript-astrochemistry-panspermia-mongoose (npm)
- Aug 14, 2025
Malicious code in javarepo (npm)
- Aug 14, 2025
Malicious code in javarat (npm)
- Aug 14, 2025
Malicious code in javapong (npm)
- Aug 14, 2025
Malicious code in javapay (npm)
- Aug 14, 2025
Malicious code in javaodev (npm)
- Aug 14, 2025
Malicious code in javagift (npm)
- Aug 14, 2025
Malicious code in javagames (npm)
Page 5517 of 6,634