Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,178 total · sorted newest first- Sep 17, 2026
Malicious code in kiwi-v11-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiwi-zulu-anhj (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kkkarem (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kkkaremm (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiwi-xigua-h597 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiwmnamnw (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiwi-yacht-vtmp (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiwi-vista-csy498-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in klasemen-liga-inggris (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kjtkeygclqrsnoph (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kmnb (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kk-proxy (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiwi-vanilla-htjd (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kkrfunds (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kknzougrdmvpfeat (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kkkaremn (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiwi-watermelon-banana-zabnl (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiwi-zulu-xnao (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiwi-whiskey-78kf (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kkkaremnn (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kmvcnq-devapptea (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiwi-ynq-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiwi-uranium-fkn516-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiwi-zr2-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in klred-notthedevs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in klicker (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kk8my2025 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiwi-zucchini-mfok (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kk8myr (npm)
1 compromised version
- Sep 17, 2026
Malicious code in klaseko (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kmeet (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kjjr66 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiwi-xigua-x9qd (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kjnschqumowlxfze (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiwi-zulu-vdyv (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiwi_vicious (npm)
1 compromised version
- Sep 17, 2026
Malicious code in klwjne-devapptea (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kmp1lo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kkkaremnnn (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kloszar (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiwi-uniform-tango-lsird (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kjjgjgjkg (npm)
1 compromised version
- Sep 17, 2026
Malicious code in klvapzgdusimojeb (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kk8myr2025 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kk8my (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kmf-cookieservice (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiwi-yeti-kdz317-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiwi-quebec-ngyf (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiwi-piano-skj156-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiwi-qlk-project (npm)
1 compromised version
Page 237 of 7,324