Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,213 total · sorted newest first- Sep 17, 2026
Malicious code in just_chameleon-notthedev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just_minnow_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just_whippet_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in justeatapplepayjs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just_beetle_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just-array-last (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just-array-intersect (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-zas-dsfaas (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just_hyena_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just-function-compose (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just-gray-sloth (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just-array-remove (npm)
1 compromised version
- Sep 17, 2026
Malicious code in justgiving (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just_guanaco_requirement (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just_parrot_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just-function-partial (npm)
1 compromised version
- Sep 17, 2026
Malicious code in justaexpformyself (npm)
1 compromised version
- Sep 17, 2026
Malicious code in justine-soluble-pot (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just_ferret_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just-function-curry (npm)
1 compromised version
- Sep 17, 2026
Malicious code in justeat-storybook (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just_chipmunk_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just-tomato-swan (npm)
1 compromised version
- Sep 17, 2026
Malicious code in justingia (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just-array-unique (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just_sole_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-zas-dudfrss (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-zas-dsfs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-zas-drss (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-gsswa-a1s (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-za-as (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-gswasd-a1s (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-gswa-a1s (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-zs-drs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-sdfud-as (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-sdfudfdd-as (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-sdd-as (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-gswzasd-a1s (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-gsssdsad-14s (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-sdfudd-as (npm)
1 compromised version
- Sep 17, 2026
Malicious code in just-a-server (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-zas-dsfas (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-zas-durs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-zas-daaas (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-zsaa-as (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-gssad-14s (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-zas-daas (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-zas-darss (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-zas-as (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jurss-zas-durss (npm)
1 compromised version
Page 295 of 7,325