Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,331 total · sorted newest first- Sep 13, 2026
Malicious code in iqbal-poke22 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqbal-poke20 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqbal-poke28 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqbal-poke29 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqbal-poke38 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ipstringfy (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-triton-writable-cors (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-umbriel-duplex-selenium (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqbal-poke12 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-webdriverio-solis-sedna (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-wezen-sqlite-hugo (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-umbra-upgrade-nodejs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ip-checks (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iplanner (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iphttp (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ipccopy (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ipconv (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iplude-devapp (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iotcdk (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iq_delivery_recommendations (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-zephyr-nova-octans (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ipvision-selfcare (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iphonegap (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ipavowels (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-vuepress-meissa-query (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ipumsir (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iothgyksxeuvwlab (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ipwnedyou (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ipgmail (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqbal-poke10 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ipi-cli (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iphilia (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ipadcalc (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ipsecurity (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iputiljs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ipfs-pack (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iqbal-poke11 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-terser-webpack-plugin-hermes-postcss (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ips-visual-parse (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ipmacjs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-terser-webpack-plugin-grus-izar (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ipherr (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ipatra (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ipremote (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-umbriel-webdriver-manager-ini (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ip-checking (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iq1eqq (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-virtualize-alert-mu-cache (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-sync-json-andromeda (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-jasmine-ini-lyra (npm)
1 compromised version
Page 429 of 7,327