Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,580 total · sorted newest first- Sep 17, 2026
Malicious code in lazy_tarantula_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lazy_wolf_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lazyseq (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lbank-connector-nodejs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lazy_monkey_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lazy_panther_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lazy_tyrannosaurus_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lbank-connector (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lazy_moth_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lazy_silverfish_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lazy_shrimp_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lazy-sapphire-cattle (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke89 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lazy_elephant_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke83 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke82 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke80 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layui.js (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lazy_dog_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke8 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lazy_hippopotamus_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke76 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lazy-fuchsia-clam (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke91 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lazy_cuckoo_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke92 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lazy_amphibian_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke88 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke95 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke84 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke87 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke93 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke99 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lazy_dragonfly_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke98 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lazy-magenta-dog (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lazy_caterpillar_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke97 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke73 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layout-experimental (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lazy_harrier_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke94 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke81 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke78 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke9 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke96 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke77 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lazy_chicken_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke75 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layout-utils.js (npm)
1 compromised version
Page 148 of 7,312