Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,213 total · sorted newest first- Sep 17, 2026
Malicious code in jwt-element-ui-jekyll-style-loader (npm)
1 compromised version
- Sep 17, 2026
Malicious code in justmeteai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jwt-nebula-module-colors (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jwt-gravity-europa-hexo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jwt-module-pipe-chalk (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jwaves (npm)
1 compromised version
- Sep 17, 2026
Malicious code in justsite (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jw-sha3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jwt-mutation-dagda-octans (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jwt-firebase-izar-gulp (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jvkwhguyilsdpntq (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juvoft (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jwt-leda-framework-module (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jwt-magellan-sedna-stop (npm)
1 compromised version
- Sep 17, 2026
Malicious code in justtestasa (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jwt-atlas-betelgeuse-socketio (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jwt-json-commitlint-config-angular-quark (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jwt-andromeda-eridanus-bellatrix (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jwt-alphard-cz-conventional-changelog-registry (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jwt-grunt-got-module (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jvector-release (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jw2s1s (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jwt-ganymede-meissa-playwright (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jwt-bulma-private-passport (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jwt-mongodb-nestjs-gacrux (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jwnkqtsfmkbxvrge (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jwt-figures-ora-commitizen (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jwieo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jvxizlbedrwafkos (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jwt-convict-dependencies-resolvers (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jwt-jwt-nodejs-publish (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-zsa-as (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just-array-union (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just_sawfish_dumbs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just_planarian_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just_tick-appteadev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just-cyan-cockroach (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just_scallop_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just-the-docs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just-config-data (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just-next-tick (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just-elements (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just-array-flatten (npm)
1 compromised version
- Sep 17, 2026
Malicious code in justine-tea-archive (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just-olive-vicuna (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just_carp_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just_hornet_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just_cattle_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just-a-browserify-server (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just_scorpion_z3n (npm)
1 compromised version
Page 294 of 7,325