Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,337 total · sorted newest first- Sep 13, 2026
Malicious code in intact_mollusk_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in int-lib-config (npm)
1 compromised version
- Sep 13, 2026
Malicious code in insufficient_pinniped_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in intaka (npm)
1 compromised version
- Sep 13, 2026
Malicious code in intact-beige-jaguar (npm)
1 compromised version
- Sep 13, 2026
Malicious code in intact_scorpion-silentdev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in insufficient_crawdad_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in intact_squid_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in insufficient_worm_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in insufficient_fox_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in intact_duck_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in insufficient_hyena_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in insufficient_coyote_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in intan-12 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in int_access_worldpay_sfra (npm)
1 compromised version
- Sep 13, 2026
Malicious code in int_affirm_sfra (npm)
1 compromised version
- Sep 13, 2026
Malicious code in intact_leopard_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in intact_skunk_gold-80 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in int-lib-config-utils (npm)
1 compromised version
- Sep 13, 2026
Malicious code in insufficient-lime-deer (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instrumentation-ioredis (npm)
1 compromised version
- Sep 13, 2026
Malicious code in insufficient_bug_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in insufficient-jade-panther (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_tyrannosaurus_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in insufficient-yellow-peafowl (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instrumentation-pg (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instrumentation-grpc (npm)
1 compromised version
- Sep 13, 2026
Malicious code in insufficient-red-chickadee (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_tahr_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in insufficient-plum-quail (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instrumentation-express (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_swordtail_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instreacts (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instrumentile (npm)
1 compromised version
- Sep 13, 2026
Malicious code in insufficient_aardwolf_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in insufficient_baboon_dumbs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_turtle_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in insufficient_angelfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional-violet-wren (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant_orca_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_chimpanzee_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant_porcupine_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_gull_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_leopon_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_locust-silentdev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_giraffe_requirement (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_limpet_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant_skunk_replicate_automation (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_horse_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instaspot (npm)
1 compromised version
Page 450 of 7,327