Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,578 total · sorted newest first- Sep 17, 2026
Malicious code in legitimate_lamprey_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate_coral_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate_nightingale_ivory-43 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-5mn-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legobot (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-a2e-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leimannuoka-baodian (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate_angelfish_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate-sapphire-snipe (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-8rx-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate-maroon-marmoset (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate_deer-gooddev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate_shrew_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate-plum-panda (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-0hw-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate_minnow_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate_louse_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-apple-date-pffoh (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate_asp_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-3y0-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate_frog_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate_coyote_copper-100 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lekrep (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leijure (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate_octopus_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-3l1-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate_egret-apptea (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-apple-banana-cghuc (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legoland-shared (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leihgreen (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lemon-94n-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative_starfish_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative_cicada_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative-indigo-aphid (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_trout_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative-plum-nightingale (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_unicorn_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative_sloth_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative_prawn_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate-crimson-walrus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_planarian_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative_leopard_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative_dragonfly_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative-gray-newt (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legend_dd1pc_pveew_wind (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative-brown-aphid (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative-rose-lobster (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative_tiglon_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_rooster_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate-chocolate-hummingbird (npm)
1 compromised version
Page 140 of 7,312