Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,578 total · sorted newest first- Sep 17, 2026
Malicious code in lengthy_guan_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_lungfish_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_tarsier_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_mite_gold-96 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-zulu-banana-vwybn (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_chimpanzee_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_hippopotamus_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lentengflyover-tool (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_bear_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_octopus_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_puffin_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_ferret_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-yo5-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_snake-appteadev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_stork_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_crawdad_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lentengpride-tool (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leo-password-reset-service (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lentengjoko-tool (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemputes (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_kangaroo_blush-2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lentengangkot-tool (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_sloth_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_parrot_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_earwig-smiletea (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_gopher_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_snake_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemonboy (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_scorpion_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_ostrich_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_sheep_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy-tan-salamander (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_ape_dumbs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-zulu-ccee (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lentengsoes-tool (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lentengmacet-tool (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lentengpolisi-tool (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_whale_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_pony_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lens-data (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lentengpasar-tool (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_crocodile_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lengthy_macaw_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-wzy-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-oba-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-apple-victor-idjgi (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-grape-zwmv (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-yam-jhtm (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-dvd-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-mango-cherry-ldblp (npm)
1 compromised version
Page 138 of 7,312