Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,331 total · sorted newest first- Sep 13, 2026
Malicious code in iris-3rsqa-g5lty-kelp-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iris-zenith-iyo103-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iris-y2iti-64tpg-zenith-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iris-xvlcy-eyt04-wander-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iris-yucca-lsx431-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iris-4bgmc-7zm3t-nova-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iris-asteroid-mcb936-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iris-kiwi-bmi271-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irfan-poke20 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irfanadil (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irassdhi-sedssad-sswe (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ircaddon (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irfan-poke15 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irashi-sead-sswe (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irassdhi-sds-sswe (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irassdhi-11-rwew (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ireflex (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irfan-poke18 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irfanmajid (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irator (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iris-2qmor-i4x6n-raven-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irassdhi-1-rwew (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irashi-sedssad-sswe (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irashi-wsdew-123 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irashi-wew-sza (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irfan-poke16 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irb (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irashi-sss-sza (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irassdhi-ssds1s-sswe (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irfan-poke22 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irfanameer (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irfan-poke25 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ircpybots (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irfan-poke17 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irfan-poke6 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irfan-poke23 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irce-server (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irfan-poke24 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irfan-poke5 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irfan-poke1 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irashi-sedad-sswe (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irfan-poke8 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irfanabdul (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irfanlatif (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irashi-ssss-sza (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irassdhi-12-rwew (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irfan-poke3 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irfan-poke10 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irfan-poke9 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irfan-poke7 (npm)
1 compromised version
Page 425 of 7,327