Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,319 total · sorted newest first- Sep 13, 2026
Malicious code in item-at-labieagoka (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itchy_lynx_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itchy_barracuda_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itchy_cockroach_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itchy-white-fly (npm)
1 compromised version
- Sep 13, 2026
Malicious code in item-at-labieagyeyabbjka (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itchy_lemur_copper-59 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itchy_urial_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in item-at-doa (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itchy_impala-silentdev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itchy_crocodile_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in item-at-labieagyeyabbjpeoka (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itchy_snail_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itchy_mastodon_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in item-at-labieagyeyoka (npm)
1 compromised version
- Sep 13, 2026
Malicious code in item-at-labieaoka (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itdart (npm)
1 compromised version
- Sep 13, 2026
Malicious code in item-at-duhioa (npm)
1 compromised version
- Sep 13, 2026
Malicious code in item-at-labieagyeyabka (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itchy_heron_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itchy_bear_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itchy_canid_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itchy_jaguar_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itale-dci-ytd4q (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itale-dci-rsust (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itale-dci-rshauyfyt (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itale-dci-rshafyt (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itale-dci-sysadewe (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itale-dci-sywfsetef (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itchy-ivory-chickadee (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itale-dci-ssfe (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itale-dci-rsrgt (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itam-ifut-duoa (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itale-dci-ssfres (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itale-dci-rshayt (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itale-dci-rsht (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itale-dci-rsgusytduet (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itchy-magenta-cicada (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itchy-coral-dolphin (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itale-dci-rsgustet (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itale-dci-ssetgs5 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itale-dci-rsyt (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itale-dci-rsyyt (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itale-dci-sfdaawe (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itale-dci-srfe (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itale-dci-srtrt (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itale-dci-shftyryt (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itale-dci-srtrgrt (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itchy-apricot-swallow (npm)
1 compromised version
- Sep 13, 2026
Malicious code in itale-dci-yrtdtr4q (npm)
1 compromised version
Page 402 of 7,327