Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,337 total · sorted newest first- Sep 13, 2026
Malicious code in install-testcafe-quark-meissa (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-cross-env-ultra-radiant (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-pyxis-rest-prettier (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-got-dorado-flare (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-europa-arcturus-csv (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-uninstall-eridanus-nightwatch (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-utils (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant-cash-app-money-generator-2023-code-bakaq (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-enif-yildun-pegasus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-spinner-dagda-fusion (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-paychex-deps (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-semantic-ui-warp-fork (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant-cash-app-money-generator-2023-code-hqiuy (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instal (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-build-readable-gacrux (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-mini-css-extract-plugin-test-sqlite (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-release-it-celeste-xanadu (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-ui (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-meteor-webdriver-mocha-framework (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-aquarius-jasmine-thuban (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-module (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-sagitta-forever-repository (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-chakra-ui-loopback-antares (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-fork-mdx-websockets (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-eleventy-cluster-element-ui (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-rollup-spectron-webdriver-proxima (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-enceladus-mesosphere-superflare (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-ganymede-avior-morgan (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-enif-blitz-supervisor (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instagrambotlib (npm)
1 compromised version
- Sep 13, 2026
Malicious code in installping (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant-cash-app-money-generator-2023-code-poaq3 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant-cash-app-money-generator-2023-code-jwopq (npm)
1 compromised version
- Sep 13, 2026
Malicious code in installments (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-tools (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-config-hydra-pm2 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instant-cash-app-money-generator-2023-code-jyerw (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-rimraf-nova-antares (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instadown (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-eclipse-supervisor-markdown-pdf (npm)
1 compromised version
- Sep 13, 2026
Malicious code in install-zenobia-convict-backend (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instagram-basic-display-api (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-internal (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-api-client (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-database (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-cache (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-analytics (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-logger (npm)
1 compromised version
- Sep 13, 2026
Malicious code in insomnia-smoke-test (npm)
1 compromised version
- Sep 13, 2026
Malicious code in insomnia-scripting-environment (npm)
1 compromised version
Page 452 of 7,327