Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,199 total · sorted newest first- Sep 17, 2026
Malicious code in keen-green-python (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen-violet-cuckoo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen-olive-jackal (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen_swan_dumbs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen_dolphin-appteadev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen-bronze-rhinoceros (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen_flyingfish_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen-amber-possum (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen_porpoise_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen_marmoset_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keazeiros-notthedevs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen_haddock_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen_mackerel_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kearys (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen_squirrel_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen_bobcat_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in ke-moma2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kecks (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen-copper-guineafowl (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kdofmjlhupveskwq (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keccak256-helper (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keebler-paypal (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen_crane_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen-jade-koala (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen_snipe_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen_skink_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen_cardinal_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in ke-moma (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen-amethyst-cattle (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen_hawk_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in keen_cricket_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kbezvoastwprqmdu (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kdkskx (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kbounce (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kbkjyqzmfxuhodnt (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kcpycamp (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kcruby (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-vuetify-deneb-octans (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kayqcs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kbrltzqeasmipudy (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kavitasen (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kcpb (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kdbt2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kbfnqgrwpkumvcyi (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kbcontrol (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-wolf-lacerta-aether (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kb-rnd-package (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kdjn6p3rsskz9lm3zchrej7gymbpbe4v (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kayak-yam-duob (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kb-first-package (npm)
1 compromised version
Page 271 of 7,324