Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,582 total · sorted newest first- Sep 17, 2026
Malicious code in lacerta-mineralogy-tailwindcss-gemini (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-electron-gemini-passport (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-thuban-dynamo-loopback (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-paleobotany-convict-babel (npm)
1 compromised version
- Sep 17, 2026
Malicious code in ladenes (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-eris-altair-terser-webpack-plugin (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagoon-evergreen-kwq796-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-luna-install-alphard (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-middleware-procyon-exec (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-magellan-sagitta-dotenv (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-polaris-tool-resolvers (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-geckodriver-tool-private (npm)
1 compromised version
- Sep 17, 2026
Malicious code in ladyphp (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-google-superagent-elektra (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-optimize-css-assets-webpack-plugin-unuk-prettier (npm)
1 compromised version
- Sep 17, 2026
Malicious code in laduja (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-ceres-jwt-stream (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-dotenv-parse-variables-charon-bootstrap (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-zenobia-magellan-cluster (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-rest-mocha-foundation (npm)
1 compromised version
- Sep 17, 2026
Malicious code in ladder-text-js (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagent (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lagoon-hollow-bgf252-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-mutation-lyra-loop (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-deneb-react-bootstrap-gravity (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-vulcan-lacerta-hercules (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-configstore-cz-conventional-changelog-janus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-electron-taurus-triton (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth_bfui4_ymyi6_ivy (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-betelgeuse-xanthus-upgrade (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-backend-soap-eslint-config (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth-ecosystem-hdd962-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrint (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth-volcano-gsh193-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth-cliff-zmj835-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth_cuix7_3u1cb_iris (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-apex-weywot-socketio (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth-coral-bci338-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth-cascade-hrg076-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth_abylg_0roo7_opal (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth-pucpz-0lb6l-utopia-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labour_salamander_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labsheets (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth-albatross-opo606-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth-savanna-tqb592-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacalma (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth-09y80-pq6ds-opal-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth-everest-rgd440-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth_w4a5w_btn55_trill (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-callisto-orbit-umbriel (npm)
1 compromised version
Page 169 of 7,312