Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,576 total · sorted newest first- Sep 17, 2026
Malicious code in light_tiger_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lighthouse-vinegar-neu2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lightning-violet-bjr544-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in light_lizard_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in light-silver-crane (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lido-mev-monitoring (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lichen-x02p7-gha4x-thunder-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in light_gamefowl_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in light_cow_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in light_cow_dumbs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lifeweb (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lienkible (npm)
1 compromised version
- Sep 17, 2026
Malicious code in light-coffee-lizard (npm)
1 compromised version
- Sep 17, 2026
Malicious code in light_bobcat_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in light_dingo_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lifted (npm)
1 compromised version
- Sep 17, 2026
Malicious code in light_gibbon_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lifecnc (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lichen-twshi-r04ud-zenith-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in light_guan_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lifi-contracts (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lifeup (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lichen-cj6zk-dh8wd-orbit-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in light_catshark_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in light_galliform_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in light_ferret_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in light-amber-eel (npm)
1 compromised version
- Sep 17, 2026
Malicious code in light_bandicoot_olive-46 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in light_ape_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lidewyde (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lifelab (npm)
1 compromised version
- Sep 17, 2026
Malicious code in light_flamingo_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in light_hare_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in light-fuchsia-possum (npm)
1 compromised version
- Sep 17, 2026
Malicious code in light_crow_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lifxkit (npm)
1 compromised version
- Sep 17, 2026
Malicious code in light_clownfish_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in light_grouse_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lifetime-agent (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lifematon (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljs2var-ctf (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljs13 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmlhere (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljs2v2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljs2147 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljs2147147 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljs10 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljs2-malicious (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljs2var (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljsololos (npm)
1 compromised version
Page 126 of 7,312