Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,568 total · sorted newest first- Sep 17, 2026
Malicious code in link-ui-i20n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-database (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-theta-float-class-balance (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-ui-i21n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-service (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-sdk (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-uglify-js-fermiparadox-auth (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-ui-i23n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-payment (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-user-awk-bundle-throw (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-cache (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-ursa-nova-rimraf (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-stream-global-upgrade (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-gateway (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-cloud (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-umbra-spectron-tool (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkatzju (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-taurus-callisto-cygnus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-ui-i19n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-yonder-nebula-centaurus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-update-jwt-chai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-sedna-paleomagnetism-npm (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-event (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-sync (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-logger (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linkedin-internal (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-ui-i22n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-celeste-tool-protractor (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-rest-client (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-function-info-tree-sandbox (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-cold-file-mock-info (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-solis-promise-elektra (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-non-blocking-query-canopus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-local-node-sass-puppeteer (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-sadr-helios-pulsar (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-nightwatch-aquarius-ora (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-eslint-config-jabbah-darkenergy (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-pino-pretty-react-bootstrap-cordelia (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-radiometric-umbriel-uninstall (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-babel-test-upgrade (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-gravity-cache-lyra (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-rigel-lint-leda (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-bootes-framework-javascript (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-leda-odin-fetch (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-csrf-cressida-achernar (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-emulate-double-table-book (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-got-weywot-build (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-next (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-cat-fork-char-easy (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-passport-prettier-plugin-markdown-commitizen (npm)
1 compromised version
Page 103 of 7,312