Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,579 total · sorted newest first- Sep 17, 2026
Malicious code in left_gorilla_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left_deer_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left_pigeon_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_jaguar_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lefunge (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal-orange-carp (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left_planarian_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal-amaranth-rattlesnake (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_impala-appteadev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_antelope_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_meerkat_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_mongoose_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_heron_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal-plum-goldfish (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left_moose_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_goose_dumbs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legacy-shared-frontend (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_limpet_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left_perch_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal-moccasin-gull (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_horse-toolteadev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legal_crow_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left_kangaroo_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in legacy-web3-extension (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left_dragon_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left-hand-navigation (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left_jay_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left_buzzard_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left-crimson-mongoose (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left-teal-cricket (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leectron (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left-pad-browser (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leecsa (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leekloud (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left-brown-mink (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left-coral-lemur (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left_gibbon_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left_bandicoot_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left-coffee-dolphin (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left-fuchsia-ostrich (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left_cougar_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left-chocolate-canidae (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left_bat_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in left-olive-impala (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-xenos-redis-spinner (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-xerxes-farout-procyon (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-wormhole-astrometry-module (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leechsa (npm)
1 compromised version
- Sep 17, 2026
Malicious code in ledweb (npm)
1 compromised version
- Sep 17, 2026
Malicious code in ledvance-living-style-guide (npm)
1 compromised version
Page 142 of 7,312