Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,582 total · sorted newest first- Sep 17, 2026
Malicious code in labyrinth-2my8w-67ept-nebula-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth_m44cp_8yf3f_iris (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-blackhole-juno-capella (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth-quartz-bfb310-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth_cjvvv_7pz4t_opaline (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth-aspen-uzq799-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth_nj01m_ioebj_nymph (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lacerta-auth0-callisto-dorado (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labour_smelt_amethyst-27 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth_g3mww_aik3j_raven (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labour_swordfish_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth-nymph-axa394-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth-sapphire-byr950-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labzine (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth-ufvpn-egdh0-emerald-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth-trcek-88blj-celestial-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labyrinth-quill-qfk926-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labruna (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labour_hyena_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labour_boar-appteadev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in l3mon-blog (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kyjnzu (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labour_antlion_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labour_cow-apptea (npm)
1 compromised version
- Sep 17, 2026
Malicious code in l3mon-dashboard (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labour-scarlet-zebra (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labour_marsupial_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labour_rooster_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kwaishop-radar (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kzmvopafdywcukxs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in l3mon (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labour_llama_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kyc-sdk-javascript (npm)
1 compromised version
- Sep 17, 2026
Malicious code in la-widget-login (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kwpresent (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kyso-cloud (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labour_orca_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labour_owl_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labour_finch_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in la9rock (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labour_anglerfish_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labour_gayal_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labour_mockingbird_dumbs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labber (npm)
1 compromised version
- Sep 17, 2026
Malicious code in l3mon-chat (npm)
1 compromised version
- Sep 17, 2026
Malicious code in lab-npm-package (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labour_horse_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in labour_fly_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kwtest-styleguide (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kyso-instance-server (npm)
1 compromised version
Page 170 of 7,312