Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,270 total · sorted newest first- Sep 17, 2026
Malicious code in jsii-1.x (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsii-calc (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-geochemistry-exec-publish (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-apex-bellatrix-docusaurus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-docusaurus-terser-aurora (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsnewspaper (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-aquarius-exoplanetology-semantic-release (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsdevtools (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-language-server (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jshkrnxbylzdpfqi (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-impulse-websockets-corvus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jshydra (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-backend-cluster-webdriverio (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsmaterialx (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-juno-pegasus-ursa (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jsii-calc-base (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-gatsby-eslint-plugin-parcel (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-chromedriver-pegasus-got (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-centaurus-yakutsk-comet (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-docusaurus-cosmiconfig-deimos (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-algol-antares-mutation (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-blaze-venus-antd (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-figures-gatsby-standard (npm)
1 compromised version
- Sep 17, 2026
Malicious code in json-development-publish-terser-webpack-plugin (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jscrambler-permission-utils (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-rust-grpc-quotes (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jscrambler-cookies (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-to-solve (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js3030-installation (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jscourse (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js3030-week3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js3030-week2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-sequence-diagrams (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-shas (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js3030-week1 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-sia3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jscarton (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-shq3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-sxa3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-qha3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-mods (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-cha3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-austt (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-sja3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-presets (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-donkey (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-regular (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-base64-int (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js2restutils (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-rha3 (npm)
1 compromised version
Page 307 of 7,326