Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,270 total · sorted newest first- Sep 17, 2026
Malicious code in js-component-explorer (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jrmisa (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jscrambler-dashboard-components (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-shi3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jrswizzle (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-wha3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-shc3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-she3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-sha7 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jrplidar (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js3030-main (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jrxtzn-devapptea (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-sla3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-3ha3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-task-paths (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jqueryprotectjs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js-starter-code (npm)
1 compromised version
- Sep 17, 2026
Malicious code in js3030-week4 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jquery.pstrength (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jquery-ui.ruler (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jqxcore (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jrmis (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jquery-validation-utils (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jquery.ui.core (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jquerydownloadnew (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jreject (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jquerz (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jquery.ui.tabs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jqueryoffline (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jradius (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jquey (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jquery.ui.widget.js (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jreplay (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jr-sha3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jquery.ui.mouse.js (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jquery-app-banner (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jquery-poolparty (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jquery-tools (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jquery-ui-custom (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jquery-2.1 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jqplot-custom (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jquery-ui-slider-pips (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jqtools-toolbox-expose (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jquery-double-tap-to-go (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jqmobile (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jqdc (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jquery-overscroll (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jquery-ui-i18n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jqfplwieacbzvrsk (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jpknzukxghlvosbc (npm)
1 compromised version
Page 308 of 7,326