Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,199 total · sorted newest first- Sep 17, 2026
Malicious code in kid-api (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keystone-quzon-wwl1d-yonder-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke8 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keystone_0bzhd_89wv0_blossom (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keystone-4r8qt-gojpm-fjord-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke96 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke89 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keystone_yzv2t_pq7nv_solstice (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke93 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke81 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke92 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke91 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke95 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyy (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keystone-8xuj0-kbwlm-xenith-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keystone_6bvec_7pepr_zodiac (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke86 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke82 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke85 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keypair-encryption-utils (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke98 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keystone-app (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke87 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keystone-q9lbl-2l4ff-quiver-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keystone-4rmyi-tz6yz-nebula-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke99 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keystone_epaf6_9le3i_opal (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke94 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke9 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keystone-l3lm5-zmvsr-birch-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keystone_h41zw_fglov_rainbow (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke90 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keystone_e043u_1jxoj_giraffe (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keysmoke (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke88 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke83 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keystone_lldfp_zswue_hush (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke97 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke84 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke68 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke58 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke63 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke80 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke73 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke78 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke79 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke69 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke5 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke62 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke59 (npm)
1 compromised version
Page 264 of 7,324