Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,199 total · sorted newest first- Sep 17, 2026
Malicious code in keyla-poke30 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke18 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke29 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke13 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke14 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke28 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke26 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke40 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke32 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke31 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke42 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke100 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke10 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key-gray-mosquito (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key_hookworm_gold-13 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key_grasshopper_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke11 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key-yellow-anteater (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key_wallaby_harlequin-26 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke103 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key-bronze-puma (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key-notify-stack-water-module (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key_snipe_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keycloak-server (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key-recovery-service-v2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key-pi-string-byte-easy (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key-orchestrate-promise-mu-bad (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kevinmurphy (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kevinbarbosa (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key_skunk_dumbs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key_leopard_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keycmd (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key-kernel-transpile-test-yaml (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key-salmon-chameleon (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke101 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key-sigma-dog-slow-authorize (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key_elk-silentdev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key-tree-cron-serialize-process (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke104 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keycaster (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key_albatross_orange-14 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key-azure-unicorn (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key-class-optimize-notify-fire (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kettlers (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key_mastodon-toolteadev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke1 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key-refactor-finally-optimize-pipe (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke105 (npm)
1 compromised version
Page 266 of 7,324