Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,579 total · sorted newest first- Sep 17, 2026
Malicious code in leading_gibbon_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_mule_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leandro-teadev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_prawn_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_buzzard_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_lemming_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leatherman-js (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_kingfisher_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_herring_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leafygreen-ui (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_chimpanzee_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_bovid_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in learns (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lean-coffee (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_eel-smiletea (npm)
1 compromised version
- Sep 17, 2026
Malicious code in learnx-zh (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_sheep_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_dragonfly_dumbs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_rhinoceros_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leapboard (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lebardon (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading-rose-heron (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_dragon_plum-2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_pig_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_fish_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_chinchilla_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_planarian_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_tuna_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_guppy_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leaiss (npm)
1 compromised version
- Sep 17, 2026
Malicious code in learning_npm1 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leafygreen-docs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_bass_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_squid_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_cicada_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in learnbdd (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading-teal-minnow (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leaflet-opencage-geocoding (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_bison_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leafbox (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_swordfish_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_falcon_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leading_quail_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leapviz (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leadconduit-zillow (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leadconduit-versium (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leadconduit-national-renewable-energy-lab (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leadcrm (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leadconduit-velocify (npm)
1 compromised version
- Sep 17, 2026
Malicious code in leadconduit-lendingtree (npm)
1 compromised version
Page 145 of 7,312