Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,281 total · sorted newest first- Sep 16, 2026
Malicious code in strapi-plugin-feedmeeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-portcc-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-maylog-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-listcc-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in jexkcode (npm)
1 compromised version
- Sep 16, 2026
Malicious code in bender-rspack-config (npm)
1 compromised version
- Sep 16, 2026
Malicious code in tetomood (npm)
1 compromised version
- Sep 16, 2026
Malicious code in @prime0/alanced-match (npm)
1 compromised version
- Sep 16, 2026
Malicious code in discord-players (npm)
1 compromised version
- Sep 16, 2026
Malicious code in discord-resolvers (npm)
1 compromised version
- Sep 16, 2026
Malicious code in licloud (PyPI)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-ccsuc-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in otel-span-adapter (npm)
1 compromised version
- Sep 16, 2026
Malicious code in cli-anything-ai-market (PyPI)
1 compromised version
- Sep 16, 2026
Malicious code in engin1 (npm)
1 compromised version
- Sep 16, 2026
Malicious code in swnwall (npm)
1 compromised version
- Sep 16, 2026
Malicious code in @prime0/inimatch (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-pencc-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in @prime0/pcomatch (npm)
1 compromised version
- Sep 16, 2026
Malicious code in tol8t (npm)
1 compromised version
- Sep 16, 2026
Malicious code in chai-as-agile (npm)
1 compromised version
- Sep 16, 2026
Malicious code in tetotest (npm)
1 compromised version
- Sep 16, 2026
Malicious code in process-mite (npm)
1 compromised version
- Sep 16, 2026
Malicious code in licloud (PyPI)
2 compromised versions
- Sep 16, 2026
Malicious code in discord-resolvers (npm)
1 compromised version
- Sep 16, 2026
Malicious code in discord-players (npm)
1 compromised version
- Sep 16, 2026
Malicious code in tetomood (npm)
1 compromised version
- Sep 16, 2026
Malicious code in tetotest (npm)
1 compromised version
- Sep 16, 2026
Malicious code in engin1 (npm)
1 compromised version
- Sep 16, 2026
Malicious code in chai-as-agile (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-pencc-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in strapi-plugin-ccsuc-meeb (npm)
1 compromised version
- Sep 16, 2026
Malicious code in otel-span-adapter (npm)
2 compromised versions
- Sep 16, 2026
Malicious code in swnwall (npm)
1 compromised version
- Sep 16, 2026
Malicious code in @prime0/inimatch (npm)
1 compromised version
- Sep 16, 2026
Malicious code in @prime0/pcomatch (npm)
1 compromised version
- Sep 16, 2026
Malicious code in @prime0/alanced-match (npm)
1 compromised version
- Sep 16, 2026
Malicious code in cli-anything-ai-market (PyPI)
2 compromised versions
- Sep 16, 2026
Malicious code in plogme (npm)
1 compromised version
- Sep 16, 2026
Malicious code in webpackbootstrap5 (npm)
1 compromised version
- Sep 16, 2026
Malicious code in faiss-cpu-avx512 (PyPI)
1 compromised version
- Sep 16, 2026
Malicious code in webpackbootstrapscripts (npm)
1 compromised version
- Sep 16, 2026
Malicious code in @zaka13/thing (npm)
1 compromised version
- Sep 16, 2026
Malicious code in jexkcode (npm)
6 compromised versions
- Sep 15, 2026
Malicious code in kartykp-prod-oidc-test-pkg (npm)
2 compromised versions
- Sep 15, 2026
Malware in kartykp-prod-oidc-test-pkg
1 compromised version
- Sep 15, 2026
Malicious code in kartykp-token-pkg (npm)
1 compromised version
- Sep 15, 2026
Malware in kartykp-token-pkg
1 compromised version
- Sep 15, 2026
Malicious code in tol8t (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-yayccresh-meeb (npm)
1 compromised version
Page 342 of 7,326