Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,580 total · sorted newest first- Sep 17, 2026
Malicious code in layla-poke36 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke67 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke5 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke60 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke66 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke58 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke29 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke33 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke40 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke16 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke20 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke12 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laweuf (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke10 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laxmanrao (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke1 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke100 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke17 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lava-xylophone-dgt758-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lavanyasharma (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke11 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lava-tide-dfd075-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke18 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke21 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lawlirf (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke23 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lavender-ux121-pvzlc-xanadu-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lavender-jr66q-bimn1-wander-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke25 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lavahala (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lawlief (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layers-foreign-mainly (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lavender-munq4-1mpil-grove-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke19 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laxfragor (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke24 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lavender-smab1-0r9t7-crescent-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke22 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lava-yacht-hfy974-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke15 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke14 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lavender-kmk4q-04c0e-night-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lawliet (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lava-xenon-tls920-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke13 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lavender-9w6q2-wpzp8-emerald-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in layla-poke2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in latin_fly_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laurajames (npm)
1 compromised version
- Sep 17, 2026
Malicious code in latin_grouse_z3n (npm)
1 compromised version
Page 150 of 7,312