Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,285 total · sorted newest first- Sep 13, 2026
Malicious code in jaynan (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jdcbrkytsvfimwhg (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jealous_bug_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jcatalog-react-reference-search (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javauto (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jcicorereturnservice (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javedfarooq (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jdghrd-devapptea (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-astrochemistry-panspermia-mongoose (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javastoreid (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javaodev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-magnetar-epimetheus-figures (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-stop-solis-magellan (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-chai-levels-meissa (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-auth0-selenology-blaze (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javarat (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-xenos-rigel-izar (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-postcss-loader-fornax-ariel (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-hyperion-quantumfoam-rate-limiter (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-appfabric-logger (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript3030 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-dotenv-quasar-spica (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-outercore-scripts-gridsome (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-async-enceladus-eslint-plugin (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-indus-ceres-ophiuchus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-websockets-neptune-janus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javashop (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-spinner-rocket-nightwatch (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-yonder-mdx-cypress (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-pipe-docusaurus-nodemon (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javagift (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-await-upgrade-venus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-nightmare-lint-staged-transform (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-pegasus-chariklo-standard (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-scorpius-global-framework (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-indus-europa-child-process (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-start-halley-eclipse (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javagames (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javapay (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javacuda (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javasite (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-taurus-transport-xenos (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-package-kaus-xml (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-protoplanetarydisk-yakutsk-string (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-msx-sdk (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-nodejs-lint-staged-build (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-procyon-nconf-odin (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-zenobia-procyon-orbit (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-css-minimizer-webpack-plugin-geochronology-foundation (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-readable-fetch-nconf (npm)
1 compromised version
Page 363 of 7,326