Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,213 total · sorted newest first- Sep 17, 2026
Malicious code in kale-kite-ykz423-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaleidoscope_1gbk9_7e6o9_geyser (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kale-umbrella-21h4 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kale_qbq2l_ewk7z_jigsaw (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaleidoscope_bd5do_mx4jy_xylophone (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kale-temple-b2dw (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaleidoscope-cliff-hou005-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaleidoscope-zebra-ese508-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kakurea (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kale-gxbmo-xx6ds-fjord-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kale-dock-e3yd (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaka-poke6 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaka-poke9 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaka-poke5 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kakao-pixel-web (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaka-poke3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kale-9xedz-4lgzx-unity-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaka-poke8 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaka-poke7 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kakakakka (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kakfa-service-interface-sample (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kale-albatross-crn680-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaka-poke4 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in k8s_ci (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaka-poke18 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaka-poke2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaiyu-webdatarocks (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaerwzyhlkngvxic (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaka-poke15 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaka-poke17 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaka-poke1 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kachbis (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaka-poke24 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaka-poke25 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaka-poke11 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaka-poke12 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaka-poke10 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in k3npj1 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaascript (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kafka-shopify (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaargo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in k8s-template-validator (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaka-poke23 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaka-poke22 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kajgps (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaitlynrivera (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaka-poke13 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kabusaku (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kaka-poke16 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in kafka-client-ruby (npm)
1 compromised version
Page 292 of 7,325