Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,270 total · sorted newest first- Sep 17, 2026
Malicious code in judicial_cephalopod_dumbs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jubilee-apple-oki112-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_constrictor_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_chameleon_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in judicial_guineafowl_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-miranda-carina-cordelia (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-winston-rollup-plugin-spica (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-ophiuchus-sequelize-miranda (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonrecap (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-neptune-neptune-zephyr (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-ignite-sync-link (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-testcafe-aether-blazar (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-configstore-janus-semantic-ui (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-xanadu-hapi-auriga (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-writable-grus-cli (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-update-ini-jupiter (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-nightmare-leda-rollup (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsontostream (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-semantic-ui-indus-prettier (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-html-webpack-plugin-epimetheus-spica (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-reveal-md-rollup-plugin-envconfig (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-lacerta-eris-octans (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-pino-orbit-elara (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-pegasus-metalsmith-dynamo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-sagitta-comet-module (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-lint-meissa-dotenv-safe (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-spinner-dotenv-dotenv-safe (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-framework-izar-update (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-hydra-neuromorphic-void (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-spawn-cypress-solis (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-vuetify-enif-yaml (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsons-logger (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsontobinary (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-envconfig-betelgeuse-eslint (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-init-command-bunyan (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-subduction-babel-solis (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-cross-env-terser-webpack-plugin-grunt (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonupon (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-charon-jasmine-prettier-plugin-markdown (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-jwt-avior-postcss-loader (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-vuepress-uninstall-ceres (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsontome (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-sagitta-proxima-adonis (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonwedjoken (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-prettier-stylelint-leda-halley (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-quito-iota-global (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-thuban-nodemon-nova (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsoncake (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-search (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-ophiuchus-jovian-writable (npm)
1 compromised version
Page 305 of 7,326