Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,582 total · sorted newest first- Sep 17, 2026
Malicious code in laila-botok40-sluey (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laila-bika51-breki (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laila-bakwan95-riris (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagoon-thistle-wdj542-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laila-bakso29-sukiwir (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagoon-icicle-crl222-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagoon-quasar-ksv190-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagoon-zenith-emv060-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagoon-rose-gpy887-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laila-asinan48-riris (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagoon-yucca-etn281-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laila-bakso86-ruro (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laila-bakwan27-ruro (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laila-bakso83-sukiwir (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagoon-jewel-shr048-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagoon-sunset-iea408-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laila-bakso63-ruro (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laila-bakso68-sluey (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laila-bakwan95-breki (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laila-asinan53-miaww (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagoon-moon-hmy577-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagoon-tundra-wlc725-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laila-bakwan63-miaww (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laila-asinan59-breki (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagoon-thunder-top089-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laila-bakso53-sluey (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagoon-oak-njc366-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagoon-oak-fex595-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laila-bakwan70-sukiwir (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laila-asinan35-breki (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laila-bakwan28-sukiwir (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagwxo-devapptea (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagoon-island-lar086-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laila-bakwan16-breki (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laila-bakso63-miaww (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laila-bakso3-riris (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagoon-thistle-slk112-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagoon-xylophone-uel276-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagoon-kelp-smx161-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagoon-infinity-iyv611-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-ursa-process-epimetheus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagoon-galaxy-ipr289-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-hyperion-cors-sass-loader (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-html-webpack-plugin-socketio-jabbah (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-chalk-ini-neptune (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-warp-perseus-forever (npm)
1 compromised version
- Sep 17, 2026
Malicious code in ladoputi-static (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-luna-writable-cz-conventional-changelog (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-style-loader-mini-css-extract-plugin-less (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagoon-ant-evs874-project (npm)
1 compromised version
Page 168 of 7,312