Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,241 total · sorted newest first- Sep 17, 2026
Malicious code in jtextgame (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsxswap (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jtgnalkypqrzxhes (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jstoauto (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jtr-hbs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jstiuzdorkkfcmxp (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jstoolnpp (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonweqjoken (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsua-rux (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jtlibrary (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsswapper (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_bison_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jtstream (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judgeme (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judejude (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_bass_0xrequest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_elk_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_hippopotamus_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsplc-date (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jtb-mytrips (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsteward (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_cephalopod_dumbs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jubilee-apple-oki112-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_constrictor_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_chameleon_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_guineafowl_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-miranda-carina-cordelia (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-winston-rollup-plugin-spica (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-ophiuchus-sequelize-miranda (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonrecap (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-neptune-neptune-zephyr (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-ignite-sync-link (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-testcafe-aether-blazar (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-configstore-janus-semantic-ui (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-xanadu-hapi-auriga (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-writable-grus-cli (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-update-ini-jupiter (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-nightmare-leda-rollup (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsontostream (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-semantic-ui-indus-prettier (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-html-webpack-plugin-epimetheus-spica (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-reveal-md-rollup-plugin-envconfig (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-lacerta-eris-octans (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-pino-orbit-elara (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-pegasus-metalsmith-dynamo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-sagitta-comet-module (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-lint-meissa-dotenv-safe (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-spinner-dotenv-dotenv-safe (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-framework-izar-update (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-hydra-neuromorphic-void (npm)
1 compromised version
Page 304 of 7,325