Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,568 total · sorted newest first- Sep 17, 2026
Malicious code in lintang-tea100 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lintang-tea31 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lintang-tea13 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lintang-tea24 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lintang-tea30 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lintang-tea29 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-auth0-blitz-cors (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-perseus-betelgeuse-izar (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-sync-global-test (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-loop-playwright-publish (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-sirius-xo-juno (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-mutation-orbit-triton (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-prettier-stylelint-phenomic-arcturus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-perseus-css-minimizer-webpack-plugin-cygnus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-deimos-alphard-sirius (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-ultra-vega-polaris (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-virgo-hyperion-tool (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-start-electron-builder-spectron (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-custom (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-regulus-zenobia-octans (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-commitlint-global-superagent (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-superagent-eridanus-bionics (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-carpo-webdriver-mocha-start (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-tailwindcss-altair-dotenv-safe (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-gridsome-less-loader-standard (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-mesosphere-geomorphology-blazar (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-dactyl-optimize-css-assets-webpack-plugin-less (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-reveal-md-electron-convict (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-inquirer-transport-hawkingradiation (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-pavo-meissa-aquarius (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-dotenv-safe-pulsar-restart (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-delphinus-typeorm-framework (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-ganymede-titan-gulp (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-pyxis-webdriver-manager-solis (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-gemini-aquarius-superagent (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-slidev-fork-nebula (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-terser-chakra-ui-node-config (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-install-bellatrix-geodynamo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-lint-staged-auth-terser-webpack-plugin (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-module-redis-ursa (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-nuxtjs-babel-socketio (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-markdownlint-sedimentology-winston (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-fork-writable-flare (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-xanadu-aldebaran-subscription (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-despina-async-xml (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-remark-meteor-neptune (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-link-promise-iota (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-ceres-metalsmith-non-blocking (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-eslint-mensa-development (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-pegasus-chalk-spectron (npm)
1 compromised version
Page 101 of 7,312