Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,286 total · sorted newest first- Sep 13, 2026
Malicious code in janus-install-bunyan-sync (npm)
1 compromised version
- Sep 13, 2026
Malicious code in janus-fomalhaut-rate-limiter-fusion (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jamesyoung (npm)
1 compromised version
- Sep 13, 2026
Malicious code in janus-configstore-quark-chai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in janus-indus-slides-toml (npm)
1 compromised version
- Sep 13, 2026
Malicious code in janus-chai-umbriel-install (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jamelfromage (npm)
1 compromised version
- Sep 13, 2026
Malicious code in janus-enceladus-supernova-panspermia (npm)
1 compromised version
- Sep 13, 2026
Malicious code in janus-hapi-ganymede-solis (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jameelafzal (npm)
1 compromised version
- Sep 13, 2026
Malicious code in janus-enceladus-pipe-carina (npm)
1 compromised version
- Sep 13, 2026
Malicious code in janus-apollo-alphard-acamar (npm)
1 compromised version
- Sep 13, 2026
Malicious code in janus-greatfilter-cosmiconfig-ursa (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaja-tumis15-ruro (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jamamq (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaja-tomat52-wekto (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaja-tumis68-breki (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaja-toge98-sukiwir (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaja-tumis81-sukiwir (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaja-wajit37-sukiwir (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jake-chan (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jamalcroissant (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jalilfromage (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jalapeno-hotel-ojpw (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jamalbaguette (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaja-tumis10-riris (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jalapeno-mike-j4zg (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jamalkhalid (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaja-tongseng94-sluey (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jalapeno-fir-bvpl (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaja-tomat4-sluey (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaja-wajit56-kyuki (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jalapeno-larch-fgi2 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaja-tongseng3-sluey (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaja-tongseng16-breki (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jajajejejiji (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jalapeno-cherry-k98i (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaja-tomat77-wekto (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaja-tomat45-riris (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jalette (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaja-ubi45-riris (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jalapeno-quebec-iei0 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaja-toge97-miaww (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaja-tumis31-sluey (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jakeweb (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaja-tempe96-sukiwir (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaja-telur44-miaww (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaja-tek38-riris (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaja-toge61-sluey (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaja-tiwul5-sluey (npm)
1 compromised version
Page 368 of 7,326