Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,180 total · sorted newest first- Sep 17, 2026
Malicious code in kinterval (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kismet-7lvgb-9jpwm-tempest-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kintisheff-sak (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-pulsar-nashira-equinox (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-xo-tool-polaris (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinvey-phonegap-angular-sdk (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kirogi (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kismet_htksa_lkizq_xylophone (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-iota-lint-palynology (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kintisheff-geo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-mini-css-extract-plugin-winston-spectron (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-paleoclimatology-holography-tailwindcss (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kipanta (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kismet-uu89h-xl76p-verdure-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-ophiuchus-antares-run-script (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-ora-bootstrap-redshift (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-module-apollo-pm2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinopoisk-components (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-impulse-polaris-webpack (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kingofpol (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kingchos (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kingweb (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinopoisk-yav-client (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-jabbah-chakra-ui-repository (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-mui-fornax-postcss (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kismet_bhbap_zyo2f_willow (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kingsly (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-registry-zephyr-corvus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiranpandey (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiokuryou (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-spawn-stop-browserify (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kiota-typescript (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-mocha-markdownlint-avior (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-restart-json-meissa (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kirankapoor (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-nestjs-callback-jovian (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kismet-nhxw8-ow6kg-nectar-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-inquirer-element-ui-chai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-redis-less-loader-jekyll (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-redshift-pino-pretty-prettier-plugin-markdown (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-frontend-csrf-unuk (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-gulp-leda-restart (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-exec-spectron-webdriver-child-process (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-jovian-auth-cache (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-europa-apex-sadr (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-mongodb-lepton-rollup-plugin (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-development-mdx-eclipse (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-delphinus-farout-axios (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-elektra-oauth-quark (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_guineafowl-tool (npm)
1 compromised version
Page 246 of 7,324