Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,241 total · sorted newest first- Sep 17, 2026
Malicious code in juicy_stingray_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy_hookworm_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy_coral_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_puffin_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy-lavender-leopon (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy-aquamarine-sloth (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy_galliform_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy_ant_dumbs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy-amber-ptarmigan (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicer-plugin (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy_mastodon_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_wildfowl_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy-silver-ferret (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy-chocolate-loon (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judith-m (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy_leopon_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy_beaver-gooddev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy_dragon_peach-24 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juetpy (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy_carp_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy_leech_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juhuwai (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_tuna_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy_mink_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy_gerbil_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_mosquito_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juiced (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy_crane_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy_octopus_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy-peach-termite (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy-gold-rodent (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juffer-xor (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_stork_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy_orangutan_dumbs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy_dragon_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_mongoose_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy_ladybug_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_mockingbird_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juexingde-baiwan-fuweng (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicip (npm)
1 compromised version
- Sep 17, 2026
Malicious code in juicy_gazelle_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_planarian_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_flyingfish-teagooddev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_ladybug_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_cockroach_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jspeel (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsrsasign-browser (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_boa_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsr305 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_dingo_z3n (npm)
1 compromised version
Page 303 of 7,325