Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,284 total · sorted newest first- Sep 13, 2026
Malicious code in jimmy-poke9 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jingtong-heike-biancheng (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimplunk (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jito-components (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke47 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jittery-beige-canidae (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke8 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jitsi-meet-logger (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke6 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jitsi-meet-electron (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke7 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jittery-emerald-albatross (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jinqian-mofa (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jingtong-csharp-heike-zhuru-biancheng (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jingtong-jiaoben-heiruan-gongji-jishu (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jinqjs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke5 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jira-lint (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jinahwal (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jittery-magenta-rat (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jingtong-jiaoben-heike (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jingdian-taluo-rumen (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jirhana-notthedevs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jittery-chocolate-hoverfly (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jira-agile-api (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jittery_crawdad_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimuskin (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jinqian-zhengli (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jitsi-meet-load-test (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke11 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke40 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke20 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke19 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke38 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke35 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke1 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke26 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke49 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke2 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke31 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimbooth (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke17 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke50 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke25 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke21 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke27 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke15 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke4 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke18 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jimmy-poke37 (npm)
1 compromised version
Page 355 of 7,326