Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,178 total · sorted newest first- Sep 17, 2026
Malicious code in koa-eslint-plugin-corvus-dotenv-parse-variables (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-dependencies-jabbah-telesto (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_parrot_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_cougar_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-gravity-magellan-helmet (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_squid_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-callback-ursa-private (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-callback-postcss-loader-webdriver-manager (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-electron-reveal-md-pavo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in koa-betelgeuse-luna-cassini (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_snail-apptea (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_stingray-appteadev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_finch_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knykode (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_gopher_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knmfux-devapptea (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knoll-l70vl-1ipps-opal-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knoll-gsc5b-abrky-coral-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knmwitazqylrucfo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known-lavender-dog (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known-sapphire-bat (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knoll-pcxw7-14c2a-comet-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_bobolink_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knowledge-admin (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_cat_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known-lime-fish (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_cattle_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knabees (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knoll-enjzc-bj10j-whisper-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knowledge-processor (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known-white-squirrel (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_cod_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knoll-wlgpg-jmevs-radiance-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knotsy (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knoll-cbx0a-ruz7g-xanadu-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kmz1 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_ape_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_bee-silentdev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knoll-efow7-6ddj5-plume-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knebe2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knoll-u8h2o-1k3qx-comet-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knell-player (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knoll-06u2w-hm6ri-vista-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_clam_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known_bass_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in known-green-loon (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kn96j1 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knicks-store---nba-jersey (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knexpress (npm)
1 compromised version
- Sep 17, 2026
Malicious code in knodat (npm)
1 compromised version
Page 236 of 7,324