Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,576 total · sorted newest first- Sep 17, 2026
Malicious code in lily_92vr6_x3nqm_bluebird (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lilac-jewel-nbh856-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lilypad-jungle-smt429-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lilaoseyst (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely_dog_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely_marmot_emerald-49 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely-brown-bass (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely-amethyst-nightingale (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely_woodpecker_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in like_viper_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely-teal-cardinal (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely_tiglon_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely_pinniped_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in like_quelea_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely-rose-platypus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely-ivory-impala (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely-purple-mastodon (npm)
1 compromised version
- Sep 17, 2026
Malicious code in like_scorpion_silver-76 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely_quelea_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likecoin (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely_newt_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely-brown-donkey (npm)
1 compromised version
- Sep 17, 2026
Malicious code in like_shark-appteadev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely_boar_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in like_lion_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely_crocodile_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in like_lungfish_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in like_mule_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely_wolverine-toolteadev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in like_whitefish-appteadev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely_frog_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely_lungfish_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in like_opossum_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely_falcon-appteadev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely_amphibian-appteadev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely_fly_indigo-100 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely_sheep_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely_gamefowl_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely_hookworm_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely_squid_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely_blackbird_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely_albatross_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely-aquamarine-salmon (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely_nightingale_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in likely_raven_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lightyear-cors-quasar-procyon (npm)
1 compromised version
- Sep 17, 2026
Malicious code in like_egret_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in like-green-rooster (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lightning-yellow-atl710-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lightyear-troposphere-adonis-kronos (npm)
1 compromised version
Page 124 of 7,312