Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,568 total · sorted newest first- Sep 17, 2026
Malicious code in link-sequelize-arcturus-nightwatch (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-commitizen-warp-nightmare (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-ora-gatsby-babel (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-sails-promise-dynamo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-phoenix-jsonp-concurrently (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-slidev-dione-markdown-pdf (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-gravity-css-loader-arcturus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-ora-loglevel-andromeda (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-loopback-hydrogeology-gacrux (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-flare-loglevel-command (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-event-impulse-pulsar (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-cron-simulate-assert-log (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-jovian-sedna-heka (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-kinetic-phenomic-node-config (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-server-bootes-spawn (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-gulp-warp-janus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-meissa-colors-nightmare (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_krill_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_lynx_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-aldebaran-library-cli (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-await-hydra-bellatrix (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_gecko_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_pike_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_dragon_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_mule_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_koi_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_shrimp_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linickx (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_sole_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_kite_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_squid_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_python_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_crocodile_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_rodent_dumbs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_skunk_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_fish_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_harrier_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_meerkat_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_lamprey_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-async-global-reveal-md (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lingxing-zhilv (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_lizard_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_lungfish-smiletea (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_earthworm_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-algol-nuxtjs-cassini (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_ptarmigan_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_mosquito_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_dove_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in linguistic_finch_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in link-astrometry-gulp-transhumanism (npm)
1 compromised version
Page 104 of 7,312