Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,331 total · sorted newest first- Sep 13, 2026
Malicious code in invisible_crawdad_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invisible_pony_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved_ermine_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invisible-amethyst-newt (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invalid-polyfill-boundary (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invoiceserv (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved-sapphire-quail (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invisible-red-leopard (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved_gorilla_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invisible_llama_dumbs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inul-poke25 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invisible_chickadee_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved-indigo-hedgehog (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invisible_clownfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invisible_armadillo_dumbs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved_elephant_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invisible_elephant_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invisible_elk_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invalid-polyfill-missing (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inventory-models (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved-peach-heron (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved_cicada_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in involved-brown-bonobo (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invisible_dragonfly_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invisible_crocodile_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invalid-dependency (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invoicingserv (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invisible_gibbon_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inul-poke5 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invenio (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inul-poke9 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invent-with-python-zh (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invisible_marmoset_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in invisible_hippopotamus_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inul-poke8 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inul-poke18 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inul-poke19 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inul-poke1 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inul-poke11 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inul-poke12 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inufi-gobali-jan (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inufi-gobali-jaruan (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inul-poke21 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inul-poke23 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inul-poke20 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inul-poke17 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inul-poke10 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inul-poke2 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inul-poke13 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inufi-gobali-janua (npm)
1 compromised version
Page 434 of 7,327