Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,281 total · sorted newest first- Sep 17, 2026
Malicious code in kartykgithub-takedown-a (npm)
4 compromised versions
- Sep 17, 2026
Malware in kartykgithub-takedown-a
1 compromised version
- Sep 17, 2026
Malicious code in idx_form_script (npm)
1 compromised version
- Sep 16, 2026
Malicious code in laycot (npm)
1 compromised version
- Sep 16, 2026
Malicious code in pkg-rollback-dreed-viced-sonic-ponds (npm)
- Sep 16, 2026
Malicious code in kartyk-github-token-pkg (npm)
2 compromised versions
- Sep 16, 2026
Malicious code in kartyk-github-single-ver-pkg (npm)
- Sep 16, 2026
Malware in pkg-rollback-dreed-viced-sonic-ponds
1 compromised version
- Sep 16, 2026
Malware in kartyk-github-single-ver-pkg
1 compromised version
- Sep 16, 2026
Malware in kartyk-github-token-pkg
1 compromised version
- Sep 16, 2026
Malicious code in kartyk-github-oidc-test-pkg (npm)
3 compromised versions
- Sep 16, 2026
Malware in kartyk-github-oidc-test-pkg
1 compromised version
- Sep 16, 2026
Malicious code in rak-lab-yoav-orca-zrktd2cp5hjmo4x7 (PyPI)
1 compromised version
- Sep 16, 2026
Malicious code in trongappy (PyPI)
1 compromised version
- Sep 16, 2026
Malicious code in trongappy (PyPI)
1 compromised version
- Sep 16, 2026
Malicious code in praetorian-mind-rce-test-2026 (PyPI)
1 compromised version
- Sep 16, 2026
Malicious code in rak-lab-yoav-orca-zrktd2cp5hjmo4x7 (PyPI)
1 compromised version
- Sep 16, 2026
Malicious code in praetorian-mind-rce-test-2026 (PyPI)
3 compromised versions
- Sep 16, 2026
Malicious code in idx_form_script (npm)
2 compromised versions
- Sep 16, 2026
Malicious code in strapi-plugin-persh-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-conresh-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in process-mite (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-os-rec (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-maylog-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-portcc-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-pysh-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-feedmeeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in @traktis/core (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-ccrec-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in @traktis/environment (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-ccip-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-cccon-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-osag (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-listcc-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-honey-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-ccrev-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-perev-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in @traktis/core (npm)
2 compromised versions
- Sep 16, 2026
Malicious code in @traktis/environment (npm)
2 compromised versions
- Sep 16, 2026
Malicious code in strapi-plugin-os-rec (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-ccrev-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-osag (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-ccrec-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-cccon-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-persh-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-pysh-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-perev-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-ccip-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-honey-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-conresh-meeb (npm)
1 compromised version
Page 341 of 7,326