Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,180 total · sorted newest first- Sep 17, 2026
Malicious code in kind-orange-cattle (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind-ivory-raven (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_bonobo_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_pike-teagooddev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_meerkat_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-betelgeuse-relay-toml (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_fly_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_bird_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind-plum-mongoose (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_mammal_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_porpoise_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinectfun (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind-beige-chimpanzee (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-configstore-nuxtjs-colors (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_rodent_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kindle-fast-metrics-javascript-sdk (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_crayfish_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-backend-technocracy-archaeometry (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_rodent_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_smelt-apptea (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_scallop_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_rooster_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-cressida-schema-betelgeuse (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_yellow_snipe-70-tisubasah (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_swan_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-blackhole-meteor-global (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_pelican_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_pike_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_catshark_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_wildfowl_dumbs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_sheep_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind-rose-silverfish (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-bunyan-dotenv-safe-quantum (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-antares-weywot-virgo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_krill_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kinetic-atlas-run-script-delphinus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind-violet-snake (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_bug_dumbs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_crow_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kind_aardvark_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kimdjiwon-ersui-vert (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kim-s-memeq (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kilo-yankee-november-itgzi (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kim-jiwon-me (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kim-jiwon-ba (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kim-jiw-bau (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kilo-strawberry-alpha-hgule (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kilo-zulu-lemon-rdmmz (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kim-so-memeq (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kilo-ugli-byot (npm)
1 compromised version
Page 247 of 7,324