Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,173 total · sorted newest first- Sep 17, 2026
Malicious code in kupaio-kulaa-jokiohakaasikimalo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kulaa-jiakajualai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kula-jok (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kula-jai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kula-joiluna (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kulaa-jiaklai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kulaa-jiakai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kulaa-jiaka (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kila-jakaiaoaai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kila-jakaiaoai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kila-jakaiai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kia-jakaooai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupai-ukuta-jokablaiokai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupai-lulikoniuta-igvugukafu (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kia-jakasfoai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupai-ukuta-jokabiokai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kil-kakoi (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupai-ukuta-jok (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupai-ukuta-joki (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kia-jakaoai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kia-jakafafsfoai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupai-ukuta-jokaiokai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kia-jakaopoai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kia-jakafafswafofoai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupai-lulikonit-igugfu (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupai-lulikoniuta-igugkfu (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kia-jakafafswofoai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kia-jakafafswaofoai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kil-kai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kil-jakaiai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kia-jakaiaopoai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupai-lulikoniuta-igugukafu (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupai-lulikoniuta-igugfu (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kia-jakafasfoai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupai-ukuta-jokaai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kil-kaoakoi (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupai-lulikont-igugfu (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupai-lulikon-igugfu (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kila-jakaiaai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupai-lulikoniuta-igavugukafu (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kia-jakaiaolapoai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kia-jakafoai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kia-jakaaopoai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupai-ukuta-jokakai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupai-lulio-igugfu (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupai-ukutia-jok (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupaio-kil-jakai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kuku-poke8 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kupai-lukta-joali (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kuku-poke9 (npm)
1 compromised version
Page 211 of 7,324