Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,199 total · sorted newest first- Sep 17, 2026
Malicious code in karma-got-reveal-md-proxima (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-upgrade-backend-hermes (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-deneb-umbra-yaml (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-delphinus-materialize-dotenv-safe (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-phenomic-standard-mdx (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-electron-builder-blitz-lacerta (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-ulx2j-ax8si-hearth-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-cross-env-mocha-grus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-hermes-supervisor-sedna (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-jnaf9-xzor1-lavender-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-cypress-pyxis-redis (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-humanity-stack (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-europa-janus-hercules (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-hapi-sedna-testcafe (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-console-reporter (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-gridsome-backend-hydra (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-deneb-eslint-plugin-public (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-gatsby-nodejs-europa (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-heka-shelljs-css-minimizer-webpack-plugin (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma_a70l3_z1fzv_kryptonite (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-pipe-leda-ignite (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-spawn-webpack-yonder (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-repository-request-helmet (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-rimraf-start-hercules (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-fornax-sequelize-ophiuchus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-fornax-react-bootstrap-draco (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-puida-4cu7u-quiver-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-install-spectron-bootes (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-quasar-io-europa (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karem5 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-aether-betelgeuse-webdriver-manager (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karajinov (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karimcroissant (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-4vbyb-kbfgk-juniper-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kardashevscale-apex-neptunology-astrometry (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kapvino-sufgfoi-ugaha (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karma-centauri-nodejs-jupiter (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karboom (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karem10 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kardashevscale-despina-outercore-leda (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karimbrie (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kapvino-sufggfoi-ugaha (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karemm3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kardashevscale-element-ui-element-ui-cosmogenic (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karemm6 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karem6 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kapvino-sovni-gfi (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karemm5 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in karem7 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kardashevscale-markdown-pdf-cressida-fetch (npm)
1 compromised version
Page 274 of 7,324