Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,578 total · sorted newest first- Sep 17, 2026
Malicious code in leticiacosta (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesson-clothing-describe (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser_canid_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser_shrew_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser_hawk_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in letstryout (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser_chinchilla_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lessio (npm)
1 compromised version
- Sep 17, 2026
Malicious code in let1x5 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in let-anybody-lesson (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser_tuna_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser_lion_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser_spoonbill_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in letra (npm)
1 compromised version
- Sep 17, 2026
Malicious code in letproj (npm)
1 compromised version
- Sep 17, 2026
Malicious code in letjzsndypcavoqr (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser_dormouse_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser_dormouse_maroon-19 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level-aqua-turtle (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser_zebra_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser_crawdad_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser_shark_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lettuce-date-6zbg (npm)
1 compromised version
- Sep 17, 2026
Malicious code in letsmrt (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser_gamefowl_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser_dog_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in level-bronze-bonobo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser_guineafowl_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lettuce-zulu-74in (npm)
1 compromised version
- Sep 17, 2026
Malicious code in less-mocha-slides-umbriel (npm)
1 compromised version
- Sep 17, 2026
Malicious code in less-triton-selenology-castor (npm)
1 compromised version
- Sep 17, 2026
Malicious code in less-request-farout-delphinus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser-turquoise-panda (npm)
1 compromised version
- Sep 17, 2026
Malicious code in less-toml-antares-halley (npm)
1 compromised version
- Sep 17, 2026
Malicious code in less-loader-stream-apollo-impulse (npm)
1 compromised version
- Sep 17, 2026
Malicious code in less-protractor-nebula-figures (npm)
1 compromised version
- Sep 17, 2026
Malicious code in less-loader-virgo-phenomic-typeorm (npm)
1 compromised version
- Sep 17, 2026
Malicious code in less-radiometric-hydra-xml (npm)
1 compromised version
- Sep 17, 2026
Malicious code in less-loader-update-spica-mongoose (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser-green-pike (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lessaddin (npm)
1 compromised version
- Sep 17, 2026
Malicious code in less-prettier-stylelint-warp-telesto (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser-jade-ostrich (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser-pink-whale (npm)
1 compromised version
- Sep 17, 2026
Malicious code in less-selenium-sedna-buffer (npm)
1 compromised version
- Sep 17, 2026
Malicious code in less-non-blocking-run-script-xanthus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in less-update-kaus-build (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lesser-harlequin-python (npm)
1 compromised version
- Sep 17, 2026
Malicious code in less-loader-sedna-blaze-commitizen (npm)
1 compromised version
- Sep 17, 2026
Malicious code in less-loader-sqlite-cressida-leda (npm)
1 compromised version
Page 135 of 7,312