Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,199 total · sorted newest first- Sep 17, 2026
Malicious code in key-transparency (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key-encrypt-bad-class-kernel (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key-static-authorize-authenticate-quick (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key_flamingo_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kevinrodriguez (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key-emerald-dolphin (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key_frog_salmon-90 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key_value_model (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key-black-sole (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key_cheetah_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key_tyrannosaurus_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key_dragonfly_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke102 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in key_cephalopod_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keyla-poke12 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kestrel-iuz5s-c3us9-dynamo-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kestrel_r5j8s_lh6f6_crystal (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kestrel_ropuk_yjllf_quicksilver (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kestrel_xytu1_61sdy_meadow (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kerocinedeizel (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kestrel_w9n41_eqgxd_kaleidoscope (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kestrel-ziyzj-cbipt-quicksilver-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kestrel_6udmw_ispp1_hush (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kespapp (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kestrel-zrs7t-6e2fc-lavender-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kestrel-bn23z-8ai06-ember-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kestrel_pymox_6wh87_ocean (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kestrel_h4008_qgrcu_noir (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kerry-soluble-pot (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kestrel-uplift-psk732-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kerry-wallet-store (npm)
1 compromised version
- Sep 17, 2026
Malicious code in ketcher-react-app (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keroris (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kernellib (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-75 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-76 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-73 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-8 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-58 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kernel-promise-proxy-xml-pipe (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-63 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-64 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-6 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-72 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-66 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keresztes (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kernel-visualize-meta-import-transpile (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-61 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-74 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-9 (npm)
1 compromised version
Page 267 of 7,324