Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,199 total · sorted newest first- Sep 17, 2026
Malicious code in kayak-drone-ypze (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kccenter (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kazimirzen (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-materialize-eridanus-bellatrix (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-cluster-superagent-slidev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-auth-hermes-parcel (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-atlas-aurora-promise (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-sagitta-less-zephyr (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-uglify-js-version-node-config (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-ophiuchus-triton-passport (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-jest-miranda-rate-limiter (npm)
1 compromised version
- Sep 17, 2026
Malicious code in katrina-soluble-pot (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-bellatrix-async-astro (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-firebase-jabbah-bellatrix (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-pavo-grus-ignite (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-venus-hydra-quantum (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-gatsby-mysql-eris (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-nightwatch-uninstall-envconfig (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-hyperion-polaris-eclipse (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-unuk-miranda-radiant (npm)
1 compromised version
- Sep 17, 2026
Malicious code in katrina-wallet-store (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kato-memory (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-cassini-pulsar-tool (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-elara-relay-development (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-oauth-chakra-ui-membrane (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-petrology-postcss-loader-andromeda (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-umbra-dotenv-safe-version (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-auth0-dione-redis (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-bootes-quark-sirius (npm)
1 compromised version
- Sep 17, 2026
Malicious code in katari (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-hapi-css-loader-polaris (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-local-readable-csv (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-socketio-blaze-betelgeuse (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-mdx-miranda-pavo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-antares-update-neptune (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-materialize-event-prettier-plugin-markdown (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaula (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kato-local (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-vega-oauth-sqlite (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-less-karma-nova (npm)
1 compromised version
- Sep 17, 2026
Malicious code in katha-venuka-katha-hindi-movie (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-dorado-hyperion-ursa (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-eris-regulus-rollup (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-triton-sadr-aurora (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaus-triton-lightyear-dagda (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kasms (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma_ezdnq_hgl1e_phoenix (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kastra-oberon-spectroscopy-mocha (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kastra-stop-vuetify-jest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kastra-nebula-markdown-delphinus (npm)
1 compromised version
Page 272 of 7,324