Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,337 total · sorted newest first- Sep 13, 2026
Malicious code in instant_silkworm_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional-plum-hedgehog (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant-plugin (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_opossum_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant_crab-appteadev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant_dolphin_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant_chimpanzee_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant_carp_blue-56 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant_crane_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant-cash-app-money-generator-2023-code-ujalo (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant_starfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_guineafowl_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant_silkworm-silentdev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant_rodent_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instead-typical-growth (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional-maroon-hookworm (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant_swordtail_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_reptile_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_spoonbill_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_grouse_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional-white-moose (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_meadowlark_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_cattle_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_panda_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant_cattle_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_ocelot_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_badger_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant_manatee_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instantly-ark-survival-primal-pass-generator (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant_silkworm-tool (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_meadowlark-appteadev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_parrotfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional-scarlet-trout (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_silverfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_chameleon_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instantly-asphalt-9-legends-credits-generator (npm)
1 compromised version
- Sep 13, 2026
Malicious code in institutional_anaconda_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant_platypus_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-writable-centaurus-wolf (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-user (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-betelgeuse-zenith-nodemon (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-umbriel-quark-octans (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-geckodriver-blueshift-native (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-bellatrix-firebase-webpack (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-uninstall-mira-sass-loader (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant-cash-app-money-generator-2023-code-nakjd (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-bunyan-bellatrix-impulse (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant-cash-app-money-generator-2023-code-balpw (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-europa-aquarius-cli (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instance-detect-paypal (npm)
1 compromised version
Page 451 of 7,327