Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,300 total · sorted newest first- Sep 13, 2026
Malicious code in jacket-hedgehog-aut206-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jabbah-spica-corvus-library (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jabbah-subduction-got-duplex (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jabbah-futurology-sedna-augmentedreality (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jaccia (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jabbah-steganography-whitedwarf-astrophysics (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jabbah-graviton-on-areology (npm)
1 compromised version
- Sep 13, 2026
Malicious code in izar-subscription-bootes-kinetic (npm)
1 compromised version
- Sep 13, 2026
Malicious code in izar-thuban-lacerta-remark (npm)
1 compromised version
- Sep 13, 2026
Malicious code in j-o-h-n-wick-4-pelicula-completa-en-espanol-latino-6-k (npm)
1 compromised version
- Sep 13, 2026
Malicious code in j6-test (npm)
1 compromised version
- Sep 13, 2026
Malicious code in j4-test (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iztlaiptv (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jabbah-antares-protractor-html-webpack-plugin (npm)
1 compromised version
- Sep 13, 2026
Malicious code in j-hentai-anime (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jabbah-blitz-oauth-publish (npm)
1 compromised version
- Sep 13, 2026
Malicious code in j3-sha3 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jabbah-aether-heka-library (npm)
1 compromised version
- Sep 13, 2026
Malicious code in izberg-backoffice-inventory-js (npm)
1 compromised version
- Sep 13, 2026
Malicious code in izar-virgo-library-dotenv-parse-variables (npm)
1 compromised version
- Sep 13, 2026
Malicious code in izar-transport-transport-xerxes (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jabbah-astro-update-eleventy (npm)
1 compromised version
- Sep 13, 2026
Malicious code in j2-cli (npm)
1 compromised version
- Sep 13, 2026
Malicious code in j5-test (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jabbah-areology-archaeometry-vega (npm)
1 compromised version
- Sep 13, 2026
Malicious code in jabbah-blitz-kardashevscale-markdown (npm)
1 compromised version
- Sep 13, 2026
Malicious code in izar-aether-mensa-socketio (npm)
1 compromised version
- Sep 13, 2026
Malicious code in izar-phoenix-dione-mysql (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iymbfz-devapptea (npm)
1 compromised version
- Sep 13, 2026
Malicious code in izar-string-command-neutronstar (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iwan-tongseng69-sluey (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iwan-wajit73-breki (npm)
1 compromised version
- Sep 13, 2026
Malicious code in izar-delphinus-ursa-hermes (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iwan-tumis33-miaww (npm)
1 compromised version
- Sep 13, 2026
Malicious code in izar-bellatrix-accretion-photon (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iwan-tongseng25-riris (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ixacalc (npm)
1 compromised version
- Sep 13, 2026
Malicious code in izar-halley-mutation-rigel (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iwan-tumis3-ruro (npm)
1 compromised version
- Sep 13, 2026
Malicious code in izar-loglevel-unuk-typeorm (npm)
1 compromised version
- Sep 13, 2026
Malicious code in izar-pyxis-wasat-eris (npm)
1 compromised version
- Sep 13, 2026
Malicious code in izar-fusion-thuban-canopus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in izar-sails-eslint-plugin-bootstrap (npm)
1 compromised version
- Sep 13, 2026
Malicious code in izar-cassini-ursa-sync (npm)
1 compromised version
- Sep 13, 2026
Malicious code in izar-mdx-csrf-nightmare (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iwwa-front (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iwasm-ion-schema (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ixmixdrix (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ixmcqkwnbvglrpes (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iwan-tiwul54-miaww (npm)
1 compromised version
Page 384 of 7,326