Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,199 total · sorted newest first- Sep 17, 2026
Malicious code in keli-dywomen (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelley-soluble-pot (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke10 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-dragon-vrd871-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke7 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-fox-bkt354-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke11 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke4 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keikogi (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke19 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke14 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke12 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-kap3d-l0sah-lichen-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-il8b0-gyeqx-coral-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelley-wallet-store (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keeper-secrets-manager (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen_toucan-appteadev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-hxsmg-z9po5-silk-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke23 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-hill-kfn417-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke21 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kegcop (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-acorn-qzw749-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-horizon-pnc039-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke13 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke8 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kellymanteasproject (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kellymantea (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-aspen-ipb400-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke24 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke16 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke22 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke1 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke6 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-grove-tfv987-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke20 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke25 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keke-poke2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kekepaketti-og (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kekepaketti-git (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-48i4l-nypqa-grove-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kelp-kiwi-wji912-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen_bee_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen_nightingale_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen_parakeet_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen_shark_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kebab-notthedevs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keanasti (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen_bobolink_z3n (npm)
1 compromised version
Page 270 of 7,324