Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,576 total · sorted newest first- Sep 17, 2026
Malicious code in liable_falcon_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in liable-brown-scallop (npm)
1 compromised version
- Sep 17, 2026
Malicious code in liable_cardinal_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in liable-azure-dragon (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-50 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-48 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-42 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in liable_aphid_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-44 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in liable-purple-gopher (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-43 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in liable_beaver_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-8 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in liable_gerbil_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in liable_chickadee_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-49 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-6 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in liable_kite_brown-92 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in liable-emerald-seahorse (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-7 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in liable_crawdad_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-45 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in liable_albatross-appteadev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-47 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-9 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in liable-red-dormouse (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-40 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in liable_hookworm_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-51 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-41 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in liable_dormouse_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-5 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in liable_cicada_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-46 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in liable_caterpillar_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in liable-rose-crawdad (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-4 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-26 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-38 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-34 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-36 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lgjipi-devapptea (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-23 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-28 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-15 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-27 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-19 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-16 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-20 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-18 (npm)
1 compromised version
Page 131 of 7,312