Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,331 total · sorted newest first- Sep 13, 2026
Malicious code in io-restart-less-neptune (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-ini-antares-radiometric (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-charon-dactyl-pyxis (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved_ptarmigan_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-quark-babel-centaurus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-gulp-apollo-javascript (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inwentarz (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved_jaguar_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved_hookworm_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-publish-antd-outercore (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved_mite-silentdev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-cache-webdriverio-carina (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved_krill_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-unuk-pegasus-concurrently (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-geckodriver-local-publish (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iobroker.tr-064-community (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-mutation-eslint-izar (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iojds (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-pino-pretty-start-ultra (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved_orca_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iobeam (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-cordelia-meteor-filament (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-non-blocking-hermes-mocha (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved_rooster_amber-27 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved_wren_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved_pinniped_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-node-config-rate-limiter-concurrently (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved_walrus_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-umbriel-betelgeuse-chakra-ui (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-frontend-jasmine-ursa (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iodash (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-octans-taurus-sedna (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved_lemming-notthedev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iobloa-minisspe-amiialo (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iobroker.covid-19 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in io-nestjs-ora-wezen (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved_bison_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved_centipede_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invisible_smelt_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invoicepy (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inul-poke7 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invisible_booby_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invisible_mongoose_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved_anteater_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inul-poke4 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invisible_tick_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved-amethyst-pigeon (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invalid-polyfill-boolean (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invisible_skunk_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invisible_guppy_requirement (npm)
1 compromised version
Page 433 of 7,327