Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,331 total · sorted newest first- Sep 13, 2026
Malicious code in ira-41 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-39 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irashi-s-a (npm)
1 compromised version
- Sep 13, 2026
Malicious code in irashi-2a1-re2ff (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-38 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-32 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqbal-poke59 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-35 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqbal-poke56 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-20 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-2 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqbal-poke64 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-29 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-10 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqbal-poke62 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqbal-poke70 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-33 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-12 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-23 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-30 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-1 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-37 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqbal-poke65 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqbal-poke60 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-28 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-21 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqbal-poke68 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqfight (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-3 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-11 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-15 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-36 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-22 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqbal-poke7 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqbal-poke63 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqbal-poke8 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-14 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-17 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-27 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-18 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-24 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqbal-poke66 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-34 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqbal-poke58 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqbal-poke6 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqbal-poke67 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqbal-poke9 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-31 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-16 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ira-13 (npm)
1 compromised version
Page 427 of 7,327