Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,284 total · sorted newest first- Sep 13, 2026
Malicious code in jeep-poke30 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke43 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke4 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke32 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke33 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke49 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke36 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke46 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke39 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke6 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke5 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke47 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke9 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jefftrax (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jefqob-devapptea (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke48 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke38 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke20 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jealous_ant_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke11 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jealous_deer_dumbs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeasatra-notthedevs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jealous_reindeer_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke28 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke10 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jealous_caterpillar_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jealous_flyingfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jealous_clownfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jealous_aphid_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke15 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jealous_mollusk_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jealous_crow_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke26 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jealous_jackal_green-81 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke27 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke21 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke2 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jealous_pony-appteadev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jealous_parrotfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke14 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jedismash (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke13 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke18 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke16 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jealous_rooster-teagooddev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke24 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke19 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke23 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jeep-poke1 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jealous_capybara_requirement (npm)
1 compromised version
Page 361 of 7,326