Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,178 total · sorted newest first- Sep 17, 2026
Malicious code in koncolx (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koala-quasar-snk474-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kobi--front-helpers (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koko-poke3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koedvulqjwxrmska (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kobliha (npm)
1 compromised version
- Sep 17, 2026
Malicious code in konacli (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kokoro-tts (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kocal-server (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kodsuli (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koko-poke12 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koelsch (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koko-poke1 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kol-demo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koko-poke17 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koala-zenith-ntb487-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koko-poke4 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koko-poke2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koko-poke8 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koko-poke5 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kocal (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koko-poke21 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kolstat (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kommvahl (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koko-poke15 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koko-poke22 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koko-poke19 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koko-poke9 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kokboka (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koko-poke14 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koko-poke13 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koko-poke16 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koala-uranium-agp734-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koko-poke25 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in komacorp (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koala-xerus-gvd334-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koko-poke6 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in konani (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kolmobile (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koko-poke10 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koko-poke20 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koala-nugget-rfx340-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-redisy (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-xml-chariklo-perseus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-soap-loglevel-hyperion (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koala-crystal-lwy848-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-module-bootstrap-spica (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-test-cygnus-airbnb (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koala-jungle-wok275-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-process-gatsby-stream (npm)
1 compromised version
Page 234 of 7,324