Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,199 total · sorted newest first- Sep 17, 2026
Malicious code in kentung-53 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-25 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-24 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-43 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-37 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-32 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-54 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kenmcmil-slot (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-11 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-21 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kembuteirul (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kendo-react-messages (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-whirlpool-rjg403-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-16 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-10 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-20 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kendo.core.min (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-17 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-18 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-tide-azp985-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-19 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-22 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-tulip-bif360-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-nimbus-ahk549-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kenmcmil (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-1 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kennedy-teadev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-yacht-slw305-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-14 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-xylophone-gpk255-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-mieow-7b9r2-alchemy-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-12 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-reef-fcj514-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentico-kontent-angular-http-service (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-phv21-uhi1b-rose-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-13 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kentung-15 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke17 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke9 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-fjord-sxj057-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke15 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-gorilla-eaa530-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-30onm-abxgx-frost-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-iceberg-vlx739-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-horizon-eua884-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-br0yo-tus4l-vista-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke18 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke5 (npm)
1 compromised version
Page 269 of 7,324