Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in india-banana-zcxj (npm)
- Aug 14, 2025
Malicious code in india-banana-xray-uadxb (npm)
- Aug 14, 2025
Malicious code in india-ba6-project (npm)
- Aug 14, 2025
Malicious code in india-alpha-uniform-gyywa (npm)
- Aug 14, 2025
Malicious code in india-a8t-project (npm)
- Aug 14, 2025
Malicious code in india-9k4-project (npm)
- Aug 14, 2025
Malicious code in india-8ep-project (npm)
- Aug 14, 2025
Malicious code in indexhtml-cli (npm)
- Aug 14, 2025
Malicious code in indexhtml (npm)
- Aug 14, 2025
Malicious code in index-gamma-await-sanitize-private (npm)
- Aug 14, 2025
Malicious code in indentui (npm)
- Aug 14, 2025
Malicious code in indah-soto89-kuki (npm)
- Aug 14, 2025
Malicious code in indah-sate33-kuki (npm)
- Aug 14, 2025
Malicious code in indah-mangga4-sukiwir (npm)
- Aug 14, 2025
Malicious code in indah-klipo64-kuki (npm)
- Aug 14, 2025
Malicious code in indah-gudeg76-breki (npm)
- Aug 14, 2025
Malicious code in indah-bakwan53-sukiwir (npm)
- Aug 14, 2025
Malicious code in indah-bakso45-sukiwir (npm)
- Aug 14, 2025
Malicious code in incrowd (npm)
- Aug 14, 2025
Malicious code in incrmean (npm)
- Aug 14, 2025
Malicious code in includesec-dependency-confusion (npm)
- Aug 14, 2025
Malicious code in Incheon (npm)
- Aug 14, 2025
Malicious code in in-process-engine (npm)
- Aug 14, 2025
Malicious code in imunify-plugin-client (npm)
- Aug 14, 2025
Malicious code in imsbench (npm)
- Aug 14, 2025
Malicious code in imrpjs (npm)
- Aug 14, 2025
Malicious code in imrp-sandbox (npm)
- Aug 14, 2025
Malicious code in imrp (npm)
- Aug 14, 2025
Malicious code in impulse-vortex-writable-blaze (npm)
- Aug 14, 2025
Malicious code in impulse-resonance-soap-cryonics (npm)
- Aug 14, 2025
Malicious code in impulse-panspermia-release-it-europa (npm)
- Aug 14, 2025
Malicious code in impulse-mesosphere-standard-morgan (npm)
- Aug 14, 2025
Malicious code in impulse-cluster-gravitationalwave-resolvers (npm)
- Aug 14, 2025
Malicious code in improveme (npm)
- Aug 14, 2025
Malicious code in impresora (npm)
- Aug 14, 2025
Malicious code in import-user-reject-decode-async (npm)
- Aug 14, 2025
Malicious code in import-process-orchestrate-stub-phi (npm)
- Aug 14, 2025
Malicious code in import-omega-star-compress-wind (npm)
- Aug 14, 2025
Malicious code in import-mysql (npm)
- Aug 14, 2025
Malicious code in import-grep-void-await-minify (npm)
- Aug 14, 2025
Malicious code in import-cron-test-decompress-log (npm)
- Aug 14, 2025
Malicious code in import-big-runtime-permission-web (npm)
- Aug 14, 2025
Malicious code in impinj-is-tool (npm)
- Aug 14, 2025
Malicious code in impertinent (npm)
- Aug 14, 2025
Malicious code in impermute (npm)
- Aug 14, 2025
Malicious code in imovieapp (npm)
- Aug 14, 2025
Malicious code in imhforms (npm)
- Aug 14, 2025
Malicious code in imgretom (npm)
- Aug 14, 2025
Malicious code in imgcycle (npm)
- Aug 14, 2025
Malicious code in imgame (npm)
Page 5529 of 6,634