Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,178 total · sorted newest first- Sep 17, 2026
Malicious code in koa-pyxis-xanadu-library (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-pipe-dorado-adonis (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koala-lagoon-ova095-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koala-frost-nfk075-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-radioastronomy-cosmogenic-mongoose (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-version-scorpius-ceres (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-postgres-blaze-electron (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-prettier-stylelint-link-google (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-neptune-slidev-tool (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-zenobia-unuk-playwright (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-vulcan-auth-quasarjet (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-vega-zenith-canopus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-polaris-wasat-pegasus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-testcafe-koa-zephyr (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-react-sidecar (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-speleology-greatfilter-gravitationalwave (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-schema-hyperion-indus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-odin-aquarius-cli (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-uglify-js-css-minimizer-webpack-plugin-tectonophysics (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koala-jade-xvv523-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koala-hedgehog-dra160-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-mq (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-rate-limiter-terser-sedna (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-request-backend-cors (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_mandrill_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_toucan_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_fox_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_narwhal_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knowpro-test (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-meteor-foundation-express (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-development-nebula-perseus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_leech_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-dorado-webdriverio-lynx (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_mongoose_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-body-parse (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-higgs-jasmine-wezen (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_worm_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-highway (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_herring_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_shrimp_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-kaus-sirius-draco (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knowpro (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_coral-strongdev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_rook_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-cassini-eclipse-lint-staged (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-husky-indus-europa (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knowsql (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knowtify (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-holography-charon-blueshift (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_monkey_z3n (npm)
1 compromised version
Page 235 of 7,324