Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,199 total · sorted newest first- Sep 17, 2026
Malicious code in kastra-phenomic-eridanus-hexo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kashifahmed (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kastra-version-sagitta-taurus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kastra-perseus-comet-deimos (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma_m7rym_98yk3_vortex (npm)
1 compromised version
- Sep 17, 2026
Malicious code in katal-sellercentralhmdsupport (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kastra-nextjs-tethys-acamar (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kastra-style-loader-scorpius-mui (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kastra-quantum-public-restart (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karone (npm)
1 compromised version
- Sep 17, 2026
Malicious code in katal-platform-versions (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kastra-run-script-firebase-blaze (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kastra-pino-equinox-iota (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kastra-wezen-cache-json (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kastra-pyxis-materialize-socketio (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kasino (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kastra-gravity-oauth-hermes (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kashable-mobile-common (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kastra-tachyon-andromeda-passport (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kashifahmedkashifahmed (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kastra-neutronstar-tardigrade-perseus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kashifnabeel (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kastra-flare-wasat-nodemon (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kastra-scorpius-mocha-fetch (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kastra-pm2-tardigrade-paleomagnetism (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kashifabshmed (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kashifabdul (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kastra-procyon-typeorm-auriga (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-webpack-deployment-test (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kashifadil (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kastra-regulus-yonder-magnetosphere (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kastra-entanglement-lint-staged-wormhole (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-update-slidev-websockets (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-spectron-parcel-aether (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-websockets-kastra-europa (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-lacerta-loopback-karma (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-kronos-protractor-graphql (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-taurus-browserify-prompts (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-b2ijo-n034e-yellow-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-middleware (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-prettier-slidev-forever (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-europa-australis-prompts (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-galaxy-proxima-bunyan (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-pegasus-config-europa (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-ganymede-chalk-flare (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-dependencies-geckodriver-sirius (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-gatsby-virtualreality-concurrently (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-remark-meissa-quasarjet (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-cordelia-private-izar (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-tmpl2html-preprocessor (npm)
1 compromised version
Page 273 of 7,324