Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,568 total · sorted newest first- Sep 17, 2026
Malicious code in lint-staged-javascript-jwt-zooarchaeology (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-aquarius-relay-npm (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-library-fork-perseus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-staged-blaze-concurrently-cordelia (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-hydra-gravity-prosthetics (npm)
1 compromised version
- Sep 17, 2026
Malicious code in links-3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkinbio-web-components (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-user (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-fomalhaut-commitizen-pino (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkomnia (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-centaurus-vuetify-dotenv-parse-variables (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-aquarius-morgan-ora (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkstrgo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-less-loader-jekyll-virgo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-apex-magnetar-pulsar (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-fusion-relay-cors (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedout (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkpath-paypal (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-dione-publish-prettier-plugin-markdown (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-gulp-prompts-postgres (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linode-developers (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-hapi-stop-nightwatch (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-isostasy-altair-less-loader (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-auth0-joviology-jovian (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-ui (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-duplex-bellatrix-deimos (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-utils (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-tests (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-test (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-tools (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-jabbah-elektra-scripts (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkis-website (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-branch-name (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-janus-juno-blueshift (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-ini-carpo-aldebaran (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-jupiter-prompts-version (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-framework-link-toml (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-async-ophiuchus-ganymede (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-antares-luna-nashira (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lint-cassini-metalsmith-jupiter (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-jira (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-checkout (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-admin (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-parser (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-ui-i24n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-upsilon-link-kappa-compress (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-typeorm-nebula-eigenstate (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-db (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-analytics (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-model (npm)
1 compromised version
Page 102 of 7,312