Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,285 total · sorted newest first- Sep 13, 2026
Malicious code in javascript-loglevel-chalk-soap (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javapong (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-nconf-ursa-promise (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-radioastronomy-morgan-carina (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-triton-babel-elektra (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javarepo (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-nightmare-jekyll-postcss-loader (npm)
1 compromised version
- Sep 13, 2026
Malicious code in javascript-umbriel-kronos-native (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasper-95fp6-txeo1-xenith-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasper-6rm7t-t2w99-solace-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in java-socket-cluster-decode-catch (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasper-repository (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaspilite (npm)
1 compromised version
- Sep 13, 2026
Malicious code in java-simple-void-fork-sudo (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasper-qopud-py5vt-paradise-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in java-fork-byte-double-epsilon (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine_oib8l_hda5e_firefly (npm)
1 compromised version
- Sep 13, 2026
Malicious code in java-short-string-java-yaml (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasper-yzxyc-s87r4-star-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine_smycx_tjmmc_cascade (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaticker (npm)
1 compromised version
- Sep 13, 2026
Malicious code in java-validate-monitor-link-private (npm)
1 compromised version
- Sep 13, 2026
Malicious code in java-theta-theta-zero-static (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasper-avbkv-p4win-lavender-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in java-orchestrate-awk-process-virtualize (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasper-fj3y3-aiha8-orbit-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasper-43bbw-2obmm-vortex-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine-promise-fornax-jekyll (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine_1u5ay_6cqvo_aroma (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine-typeorm-rimraf-superagent (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine-nuxtjs-terser-webpack-plugin-sirius (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine-ultra-magellan-cressida (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine-xanadu-law175-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine_cnk21_ms6kj_crystal (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine-nymph-cxc922-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine-webpack-cache-ganymede (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine-mui-yakutsk-resolvers (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine_igjpe_a7kgl_arcade (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine-supervisor-cordelia-parcel (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine-wave-bfy074-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine-vega-mensa-draco (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine-vortex-znm895-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine-less-loader-schema-wasat (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine-quito-lint-vulcan (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine_9q2ju_m7l5i_underworld (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine_i4oid_q9bdd_dawn (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine-tornado-kvy749-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine-meissa-soap-protractor (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine-waterfall-iqc218-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jasmine-metalsmith-schema-sirius (npm)
1 compromised version
Page 364 of 7,326