Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,331 total · sorted newest first- Sep 13, 2026
Malicious code in irrelevant_harrier_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-ubi66-sukiwir (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iron-demo-helpers (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-tiwul39-sukiwir (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ironwasp (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-wajit24-breki (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irrelevant_frog_requirement (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-tomat46-breki (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-wajit59-sukiwir (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irrelevant_cheetah_violet-63 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ironic (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-wajit41-miaww (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irrelevant_cheetah_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-tomat34-sukiwir (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irrelevant_termite_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-tongseng14-breki (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ironfist (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irrelevant_narwhal-apptea (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-tumis55-breki (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irrelevant-coffee-earthworm (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-tempe91-riris (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irrelevant_bee_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-ubi52-sukiwir (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-wajit98-breki (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-tiwul66-wekto (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-wajit50-sukiwir (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-tiwul49-ruro (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-ubi79-sluey (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-tongseng77-riris (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irrelevant_cuckoo_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-tomat77-miaww (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iron-bem (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irrelevant_catfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-tempe6-sukiwir (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-tongseng73-breki (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irrelevant_carp_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irrelevant_hornet_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irrelevant_panda_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-tiwul3-wekto (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irrelevant_haddock_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irrelevant-purple-rabbit (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ironeye (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-ubi85-breki (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-tomat38-sumpek (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irrelevant_guan-smiletea (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irrelevant_reindeer_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irrelevant_giraffe_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-tongseng74-breki (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-tempe92-sukiwir (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irma-tongseng90-riris (npm)
1 compromised version
Page 412 of 7,327