Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,576 total · sorted newest first- Sep 17, 2026
Malicious code in libxmljs2varkek (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljsololo2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmlrussia (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmlpupupu (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljsololoq (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmlussr2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljs21471479 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljs8 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in licence-checker (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljs2qwerty (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljsololo4 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lichen-1iocs-k4zcj-ripple-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljs2as (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljs2varaboba (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljs2var234 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljs2superbank (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmlrussia2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lichen-4qcee-425uk-yonder-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljs12 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljs9 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljsololo3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljsololo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmlussr (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljs2-1 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmljs2qaz (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmlussr1 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-pulsar-mini-css-extract-plugin-init (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmlfinal5 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libsignon (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-package-chalk-commitizen (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-nconf-writable-odin (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-procyon-babel-chariklo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libsipc (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-update-commitizen-jabbah (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-slidev-test-radiant (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libusbip (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-webdriverio-zephyr-gatsby (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmlfinal2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmlfinal (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libretee (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libucl (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-supernova-eigenstate-juno (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-thuban-galaxy-pino (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-quasar-andromeda-terser-webpack-plugin (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-nebula-rest-local (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-slides-spectron-webdriver-isostasy (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-with-exports (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-zenobia-native-cache (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libx-amount (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library.cycle.c (npm)
1 compromised version
Page 127 of 7,312