Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,331 total · sorted newest first- Sep 13, 2026
Malicious code in iomodra-foa-jali (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-forufuai-jali (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-foa-jalifa (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-foa-jafuliafua (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-forui-agoai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-foruai-agouapai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-forua-jali (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomoda-fofiri-agoai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-foruai-ujai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-foruai-uajai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-foruai-aounai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-fofiori-agoai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-foori-agoai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-foruai-agoauapai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-forufai-agouapai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-foruai-unai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-foa-jalia (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-foruuai-jai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-forufugai-jali (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-forufi-agoai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-foa-jafulifa (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-forufai-agoauapai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-foruai-unaji (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-forufa-jali (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-foruai-unajai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-foruai-agouai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-foruai-agounai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-forufuai-jai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-foruai-aunai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-forufai-agoapai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-foa-jaulifa (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomodra-fofiri-agoai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomarks (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomda-fofiri-agoai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved_piranha_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-gacrux-test-soap (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-eslint-plugin-yonder-unuk (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-version-spinner-eclipse (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-hercules-css-loader-sync (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved_porcupine_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iomeme (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ioiwds (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-sagitta-morgan-nightwatch (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-elektra-chakra-ui-configstore (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-despina-crust-brane (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-nextjs-loopback-blitz (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-radiant-kinetic-betelgeuse (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-magellan-passport-kinetic (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved_lungfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-connect-24 (npm)
1 compromised version
Page 432 of 7,327