Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,331 total · sorted newest first- Sep 13, 2026
Malicious code in iota-sedna-public-webdriver-mocha (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-pegasus-radiant-xenos (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-style-loader-lepton-cygnus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-event-lynx-semantic-ui (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-proxima-luna-promise (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-publish-farout-terser-webpack-plugin (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-stub-wind-quick-promise (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-framework-umbra-uranology (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-simulate-optimize-tree-bundle (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-report-phi-good-public (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-levels-foundation-solis (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-fomalhaut-less-loader-repository (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-dotenv-safe-webdriver-mocha-mutation (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-radiant-auth-celeste (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-spinner-dione-xml (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-fetch-cressida-kronos (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-hugo-mongoose-hapi (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-orbit-sirius-pegasus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-nu-deploy-delta-epsilon (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-gulp-colors-library (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-hydra-eridanus-protractor (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-geomorphology-rate-limiter-jasmine (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-less-loader-commitlint-config-angular-private (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-iota-avior-postcss-loader (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-nightmare-sqlite-bunyan (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-jupiter-bellatrix-lyra (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-restart-zephyr-jasmine (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-farout-aquarius-andromeda (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-scripts-phoebe-geckodriver (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-json-release-it-chai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-helmet-express-aurora (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-release-it-stream-xenos (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-node-config-nconf-zenith (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-nestjs-firebase-rest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-mira-blitz-celeste (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-dotenv-parse-variables-envconfig-mdx (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-dione-membrane-browserify (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iossegue (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iosfizmo (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-fuoa-jafuua (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ionosphere-tachyon-arcturus-jasmine (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-auth-nebula-transhumanism (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-fuoa-jaf (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-acamar-apollo-cosmos (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-fuoa-ja (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ionosphere-webdriverio-module-primatology (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-fuoa-jafua (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iosiphone (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-fuoa-jafulifua (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iota-analyze-transpile-iota-abstract (npm)
1 compromised version
Page 430 of 7,327