Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,222 total · sorted newest first- Sep 17, 2026
Malicious code in juniper-ba0fw-z3snk-opal-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juniper-oscar-767e (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juniper-agyge-g9qtz-glow-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juno-epimetheus-selenium-child-process (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juno-eclipse-pegasus-cygnus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior_muskox_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior_hedgehog_tan-37 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior_swift_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior_planarian_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior_koi_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior_herring_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior_impala_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior_tarsier_requirement (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior_puma_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior_jellyfish_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior_peacock_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juniper-a7ce1-utbt8-rose-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior_snake_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior_tortoise-strongdev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior_cardinal_coffee-98 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jungle-bamboo-oze282-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jungle-orange-j6im (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jungle-xylophone-jcox (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jungle-island-fttr (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jungle_c3r3f_pqkjf_antelope (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jungle-yeti-ndk502-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jungle_4wnfa_owrem_quarry (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jungle-thunder-fko445-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jungle-careful-blind (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior_carp_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jungle-butterfly-ifa426-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jungle-forest-nhn122-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jungle-waterfall-xck202-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jungle-kiwi-sgj290-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jungle-zenith-kth084-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior-azure-lemur (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jungle-everest-mvi676-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior_earthworm_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior_crawdad_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior-aquamarine-hookworm (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior_albatross_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior_crane_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior-magenta-elephant (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior-amaranth-silkworm (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jungle_wo2d8_qtgjw_reef (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jungle_tv1va_uk75e_banyan (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jungle-kite-gzo304-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior_finch_peach-60 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jungle-xenon-nux357-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in junior_antelope_z3n (npm)
1 compromised version
Page 300 of 7,325