Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,284 total · sorted newest first- Sep 13, 2026
Malicious code in jellyderp (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jelek-rasaaya-nur (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jelek-rasaay-batubata (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jelek-ras-batubat (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jelek-rasism-batu (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-slides-nashira-rehype (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-thermochronology-farout-sagitta (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-selenium-prettier-plugin-markdown-uninstall (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-jasmine-firebase-leda (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-javascript-draco-nebula (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-framework-meteor-dotenv-safe (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-proxima-titan-phoenix (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-nightmare-juno-eclipse (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-quark-sync-eclipse (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-jsonp-slidev-bunyan (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-transport-fusion-css-loader (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-resolvers-quark-xenobiology (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-fetch-lyra-lint (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-reveal-md-redgiant-prettier-plugin-markdown (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-markdownlint-leda-phoenix (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-nodemon-lint-enceladus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-resolvers-quark-epimetheus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-less-npm-local (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-spinner-barnard-non-blocking (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-norma-markdown-pdf-heka (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-castor-dependencies-nashira (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-delphinus-buffer-mensa (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekpress (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-dione-algol-lint (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-aurora-superagent-terser-webpack-plugin (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-deneb-uglify-js-paleobotany (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-cypress-exobiology-miranda (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-dagda-google-cross-env (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jekyll-elektra-vortex-dotenv-parse-variables (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeje6131 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke34 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke8 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke41 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke44 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke35 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeetbad (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke45 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke3 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke31 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke7 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke29 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke42 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke37 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke50 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke40 (npm)
1 compromised version
Page 360 of 7,326