Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,579 total · sorted newest first- Sep 17, 2026
Malicious code in legitimate-chocolate-hummingbird (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legend_nl0kp_7kl0k_rose (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_primate_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative_puma_dumbs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_quail_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative_snail_requirement (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_raccoon_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative-salmon-flea (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative-tomato-ox (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate-amaranth-hoverfly (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative_firefly_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative_lamprey_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legitimate-magenta-mole (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_whitefish_requirement (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative-gray-rattlesnake (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative_minnow_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative_rook_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_sole_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative_mosquito_moccasin-64 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legend_qmyr1_3npqh_fern (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative-chocolate-mastodon (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative_heron_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legend_ph02a_g6ca0_maple (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative_sole_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leggings (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_quail-appteadev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative_chinchilla_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative_catfish_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative-azure-squid (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_vulture_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative_kingfisher_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legislative_ocelot_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_anglerfish_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_camel_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left_tiger_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_frog_dumbs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left_wren_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_chicken_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_orca_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_hyena_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_chimpanzee_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal-beige-sturgeon (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left_puma_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_catfish-appteadev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left_whale_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left_skink-biggestdev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_mule_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal-harlequin-quokka (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_finch_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left_fish_z3n (npm)
1 compromised version
Page 141 of 7,312