Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,581 total · sorted newest first- Sep 17, 2026
Malicious code in laopu-shizi-erlingyiqilingjiu-yiyi (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke7 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke55 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke56 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in langda-baien-zuopinji (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laopu-shizi-erlingyiqiyier-erlingyibalinger (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke60 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke6 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke9 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lametasks (npm)
1 compromised version
- Sep 17, 2026
Malicious code in language-selector-content (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lambda-quick-monitor-optimize-book (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lapsing (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lantern-core (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke50 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lambda-daemon-cron-delta-link (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laminequiche (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke54 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in language-repo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laopu-shizi-erlingyiqilingliu-lingba (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lambda-pipeline-construct (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke57 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lara-wallet-store (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laopu-shizi-erlingyiqilinger-lingwu (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lambda-cloud-class-public-meta (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laminebaguette (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke52 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke44 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke25 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke37 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke26 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke35 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke14 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke23 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke20 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke41 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke34 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke13 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke30 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke28 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke36 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke49 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke39 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke24 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke4 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke31 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke40 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke16 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lala-poke15 (npm)
1 compromised version
Page 154 of 7,312