Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,270 total · sorted newest first- Sep 17, 2026
Malicious code in json-nashira-kinetic-castor (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-soap-postcss-tectonic (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json9 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsondatahandle (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-proxima-tailwindcss-typeorm (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-panels (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-celeste-jupiter-public (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-protractor-nestjs-auth0 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json_log_formatter (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonauthcap (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonlift (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-passport-eslint-config-chalk (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-mapping-fetch (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-charon-warp-fetch (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-schema-to-typescript-example (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-mapping-token (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-validator-utils (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-barnard-wolf-thuban (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-superagent-helios-ablation (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-packet-parser (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-umbriel-procyon-delphinus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-sirius-enceladus-scorpius (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonauto (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-miranda-karma-auth0 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonauth (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonapptoken (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-perseus-package-ursa (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-blitz-cordelia-less-loader (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonl10nfilecomparer (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-resources (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-stream-aquarius-cygnus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonp-centaurus-lyra-markdown (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-umbriel-orbit-europa (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsondatatoruby (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-ursa-css-loader-dotenv (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsonbind (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-configs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-apollo-rate-limiter-cross-env (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-bootes-ophiuchus-epimetheus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-dorado-leda-public (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-bootes-spectron-pegasus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-janus-ultra-aurora (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-configstore-venus-yakutsk (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jshashset (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jshdate (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsmsha3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-babel-regulus-void (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsify (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsii-build-tools (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsmimeparser (npm)
1 compromised version
Page 306 of 7,326