Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,337 total · sorted newest first- Sep 13, 2026
Malicious code in instacart-jira (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-event (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-db (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquisitive_slug_rose-6 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-oauth (npm)
1 compromised version
- Sep 13, 2026
Malicious code in insomnia-api (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-cloud (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-service (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-tests (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-model (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-sync (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inside-design-stencil (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-payment (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-gateway (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-checkout (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquisitive_pike_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-api (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquisitive_octopus_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-parser (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquizit (npm)
1 compromised version
- Sep 13, 2026
Malicious code in insercol (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-connect (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-auth (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-admin (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inspired (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquisitive_pinniped_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-test (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacarro-sellers-appointments-api (npm)
1 compromised version
- Sep 13, 2026
Malicious code in instacart-sdk (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquirer-remark-upgrade-run-script (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquirer-rehype-wezen-relay (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquirer-hugo-jupiter-envconfig (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquisitive-azure-snail (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquirer-cli-hermes-commitizen (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquirer-despina-arcturus-sedna (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquirer-prettier-plugin-markdown-writable-fomalhaut (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquirer-stream-metabolomics-uninstall (npm)
1 compromised version
- Sep 13, 2026
Malicious code in innovative_ptarmigan_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquirer-chalk-commitlint-config-angular-loopback (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquirer-cli-spinner-antd (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquisitive_centipede-appteadev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquisitive_antelope_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquisitive_hyena_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquirer-frontend-changelog-lynx (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquirer-winston-commitlint-cosmiconfig (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquirer-loglevel-meissa-oauth (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquirer-tailwindcss-sqlite-sirius (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquisitive-turquoise-wren (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquirer-redis-nebula-public (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inquirer-aquarius-lacerta-colors (npm)
1 compromised version
Page 453 of 7,327