Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,578 total · sorted newest first- Sep 17, 2026
Malicious code in lemon-vzr-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-echo-gmgn (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-xray-strawberry-qwova (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-banana-cwns (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-strawberry-victor-xdnms (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-november-sierra-ypzgl (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-elderberry-fig-lqoac (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-raspberry-yankee-bhebn (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-hotel-lwns (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-xdt-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-xray-wvzh (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-tango-cherry-pnsyi (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-foxtrot-kiwi-kcomt (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-yankee-xigua-cspgx (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-date-xigua-ipxic (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-banana-uvsg (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-fig-dfyo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-i0q-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-papaya-pzy3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-xerophyte-6rbr (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-kuiper-5i4j (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-mike-papa-zfgsi (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-date-wdif (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-watermelon-hihe (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-qut-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-vlh-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-oscar-orange-abbdh (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-p1s-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-yankee-jvht (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-orange-rkmb (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-yankee-pkql (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-nectarine-xray-ixxxf (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-uit-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-papaya-golf-eyqvl (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-jbe-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-o7s-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-tango-papaya-qgnyc (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-fig-spuj (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-yankee-tjcb (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-nvs-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-xray-romeo-qundn (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate_guanaco_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-8s5-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate_toucan_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate_roadrunner_requirement (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate-plum-booby (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate_aardvark_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legoquiz (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leidrea (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-6sj-project (npm)
1 compromised version
Page 139 of 7,312