Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,579 total · sorted newest first- Sep 17, 2026
Malicious code in ledger-provider (npm)
1 compromised version
- Sep 17, 2026
Malicious code in ledcandle (npm)
1 compromised version
- Sep 17, 2026
Malicious code in ledlamp (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-yildun-impulse-eslint-config (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-terser-element-ui-sails (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-version-charon-command (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-sirius-ultra-pegasus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-sequelize-pm2-sagitta (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-style-loader-pyxis-izar (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-vega-forever-airbnb (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-protractor-exoplanet-frontend (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-selenology-phenomic-webpack (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-rigel-antares-non-blocking (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-publish-koa-arcturus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-scorpius-hapi-pino-pretty (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-regulus-standard-stop (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-scorpius-fusion-docusaurus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-ursa-ganymede-arcturus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-rollup-mongodb-heka (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-tethys-webdriver-manager-hexo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-pm2-lacerta-speleology (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-prettier-sedna-elara (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-pino-pretty-command-postcss (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-prettier-antd-convict (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leda-phoenix-bellatrix-pegasus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in @kartyk-github-org/takedown-b (npm)
- Sep 17, 2026
Malicious code in @kartyk-github-org/takedown-a (npm)
- Sep 17, 2026
Malware in @kartyk-github-org/takedown-a
1 compromised version
- Sep 17, 2026
Malware in @kartyk-github-org/takedown-b
1 compromised version
- Sep 17, 2026
Malicious code in tailwindcss-form-ui (npm)
1 compromised version
- Sep 17, 2026
Malicious code in tailwindcss-form-utils (npm)
2 compromised versions
- Sep 17, 2026
Malicious code in @railone/image-utils (npm)
1 compromised version
- Sep 17, 2026
Malicious code in aiosendletter (PyPI)
9 compromised versions
- Sep 17, 2026
Malicious code in confx1789550882 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in confx1789550882 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in tailwindcss-contact-form (npm)
1 compromised version
- Sep 17, 2026
Malicious code in marketing-mcp (PyPI)
1 compromised version
- Sep 17, 2026
Malicious code in pulse-pwn-9f3a2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in ragacateslikodi (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laycot (npm)
1 compromised version
- Sep 17, 2026
Malicious code in randompkge (npm)
- Sep 17, 2026
Malicious code in randompkgd (npm)
- Sep 17, 2026
Malicious code in randompkgc (npm)
- Sep 17, 2026
Malicious code in randompkgb (npm)
1 compromised version
- Sep 17, 2026
Malicious code in randompkga (npm)
22 compromised versions
- Sep 17, 2026
Malware in randompkgb
1 compromised version
- Sep 17, 2026
Malware in randompkge
1 compromised version
- Sep 17, 2026
Malware in randompkgc
1 compromised version
- Sep 17, 2026
Malware in randompkgd
1 compromised version
- Sep 17, 2026
Malware in randompkga
1 compromised version
Page 143 of 7,312