Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,276 total · sorted newest first- Sep 17, 2026
Malicious code in joni-botok44-kyuki (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joni-bubursumsum36-riris (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joni-bakso45-riris (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joni-bakwan36-sluey (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joni-asinan99-breki (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joni-bakso74-sluey (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joni-bakwan30-remi (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joni-bubursumsum36-pore (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joni-buburayam24-breki (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joni-bakso25-miaww (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joni-bakwan44-breki (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joni-bakwan34-ruro (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joni-brongkos2-miaww (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joni-dodol63-sukiwir (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joni-brengkes21-breki (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jolly_chickadee_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jolly-warmth-ddq929-project (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joko-wajit28-sluey (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joko-ubi15-sluey (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joko-ubi38-riris (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jolly_hyena_requirement (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joko-wajit21-riris (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joko-wajit93-sluey (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joko-tumis73-sluey (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jolly_clownfish_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jolly_crow_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joko-tumis64-wekto (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jolly_sheep_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jolly_chinchilla_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jolly-tomato-gull (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joko-wajit14-sluey (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joko-ubi77-sluey (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jolly_buzzard_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jolly_amphibian_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joko-ubi10-ruro (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jolly-amaranth-kingfisher (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jones-promise (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joko-tumis71-sukiwir (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jolly_junglefowl_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jolly_mink_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joko-wajit37-breki (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joko-tumis68-miaww (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joko-ubi7-riris (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jolly_ermine-gooddev (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jolly_turkey_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joko-ubi97-miaww (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jolly_camel_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jolly-beige-marten (npm)
1 compromised version
- Sep 17, 2026
Malicious code in jolly-azure-cheetah (npm)
1 compromised version
- Sep 17, 2026
Malicious code in joko-ubi70-sluey (npm)
1 compromised version
Page 323 of 7,326