Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,576 total · sorted newest first- Sep 17, 2026
Malicious code in lia-17 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-10 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-31 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lhdnysawcxbgukrk (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-39 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-37 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-29 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-33 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-13 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-21 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-35 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-14 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-32 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-22 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-30 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-25 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lg-mutator-mobile-ads (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lhrwvaebftsxmkjk (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-11 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-24 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-1 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lia-12 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexicrypt (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexicalutils (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lfgjkvmrzyueksoh (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leysersfx (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexical-olive-cow (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexical-peach-toad (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexical-azure-hornet (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexical_salmon_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexicalclipboard (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexical_kiwi_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexical_cougar_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexical_wildebeest_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexical_mosquito_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexical_eagle_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexical_hawk_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexiokan (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexical_prawn_emerald-96 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexical_squid_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexical_egret_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexical_damselfly-smiletea (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexiokkan (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexical_python_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexical_scallop_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexical_firefly_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexical_bovid_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lexical_slug_z3n (npm)
1 compromised version
Page 132 of 7,312