Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,276 total · sorted newest first- Sep 17, 2026
Malicious code in joy_qvtit_zz7lg_wander (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joviology-heka-accretion-speleology (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jovian-mocha-ignite-zephyr (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jovian-sass-loader-native-cassini (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joviology-betelgeuse-saturnology-webdriverio (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joviology-capella-aether-stratosphere (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jovian-postgres-webdriver-mocha-await (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joy_zhxtt_yu975_zenith (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jovian-pipe-pegasus-cz-conventional-changelog (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joviology-fomalhaut-superagent-fetch (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joyous-orange-gecko (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joy_9mnpk_yjdfb_kryptonite (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joviology-pulsar-archaeoastronomy-remark (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joy_kzsfu_djgbf_xylophone (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jovian-mira-blaze-prompts (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joviology-shelljs-sass-loader-areology (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joy_lggkg_opf8t_solstice (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jovian-izar-subscription-titan (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joyous-beige-gerbil (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joy_ajgx4_wwrqd_jasmine (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jovian-nodemon-winston-andromeda (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jovian-hydra-chakra-ui-rimraf (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jovian-mocha-postgres-typeorm (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joy_4trak_jh2tm_labyrinth (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joviology-nuxtjs-ursa-lacerta (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joy_ughwc_2smbp_echo (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joviology-void-pino-pretty-sadr (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joviology-mocha-cluster-redshift (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jovian-proxima-dotenv-ariel (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joviology-standard-iota-outercore (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jovian-version-wolf-jest (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jovian-pegasus-fork-figures (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joviology-exobiology-antares-webpack (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jovian-rollup-plugin-jest-polaris (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jovian-less-loader-draco-wasat (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jovian-native-google-altair (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jovian-loopback-terser-webpack-plugin-protractor (npm)
1 compromised version
- Sep 17, 2026
Malicious code in josrep (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jovian-hercules-hydra-antares (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jotkaimcswdlzqep (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joni-tongseng23-ruro (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joni-wajit52-sluey (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joshuamurphy (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jordan-amir (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jovian-andromeda-altair-auriga (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joni-wajit88-sukiwir (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jovian-dependencies-test-mui (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jovian-docusaurus-carpo-commitlint (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jotform-webhook-test (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jovian-deneb-global-json (npm)
1 compromised version
Page 310 of 7,326