Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,576 total · sorted newest first- Sep 17, 2026
Malicious code in level_rook_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level_chipmunk_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in levels-alphard-meteor-meissa (npm)
1 compromised version
- Sep 17, 2026
Malicious code in levels-carpo-nightwatch-local (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level-lavender-bobcat (npm)
1 compromised version
- Sep 17, 2026
Malicious code in levels-adonis-wezen-nodemon (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level_grasshopper_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in levels-carpo-fusion-pulsar (npm)
1 compromised version
- Sep 17, 2026
Malicious code in levels-await-postcss-comet (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level_lion_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level-crimson-seahorse (npm)
1 compromised version
- Sep 17, 2026
Malicious code in levels-bootes-charon-tool (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level_catshark_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level_ox_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level-sapphire-moose (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level_ferret_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level_moose_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level_falcon_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level_whippet_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level_chickadee_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level_aardvark_black-35 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level_python_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level-yellow-crow (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level_canidae_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in levels-eclipse-await-cressida (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level-json-cache (npm)
1 compromised version
- Sep 17, 2026
Malicious code in levels-convict-json-dynamo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level-copper-firefly (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level-json-wrapper (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level_bat_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level-legacy (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level_giraffe_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in levels-comet-axios-rate-limiter (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level_lungfish_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lessonly-chrome-extension (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser_peafowl-notthedev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in letotests (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level-client (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser_chickadee_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser_mandrill_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser_antlion_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser_tiglon_dumbs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lettuce-wormhole-5bh3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lettuce-flare-w6xj (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser_condor_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesson-dream-death (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser_trout_dumbs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser_beetle_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leticiacosta (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesson-clothing-describe (npm)
1 compromised version
Page 134 of 7,312