Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,337 total · sorted newest first- Sep 13, 2026
Malicious code in innocent_boa_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in innobute (npm)
1 compromised version
- Sep 13, 2026
Malicious code in innercore-yildun-blaze-robotics (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inland_lion_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inner_porpoise_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inner-lime-mink (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inner_cougar_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in innocent_crocodile_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in innercore-magnetar-xerxes-galaxy (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inner_hookworm_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inner_opossum_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inner_barracuda-smiletea (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inner_marlin-apptea (npm)
1 compromised version
- Sep 13, 2026
Malicious code in innocent_bison_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in innmind (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inland_locust_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in innocent-package (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inland_felidae_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in innercore-alphard-eslint-config-xerxes (npm)
1 compromised version
- Sep 13, 2026
Malicious code in innercore-solis-plutology-entanglement (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inner_dormouse_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inner-coffee-cougar (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inland_jellyfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in innocent_chimpanzee_requirement (npm)
1 compromised version
- Sep 13, 2026
Malicious code in innercore-superposition-lint-staged-adonis (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inline-dep (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inland_magpie_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inner_flyingfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inner_starfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inland_chicken_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_crawdad_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_bobolink_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_hippopotamus_violet-57 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_owl_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inland_aardvark_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_yak_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inland_caribou-appteadev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inject.dll (npm)
1 compromised version
- Sep 13, 2026
Malicious code in initial_worm_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_angelfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_aardwolf_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_wren_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_hawk_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inland_clownfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inland-silver-toad (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_woodpecker_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_tyrannosaurus_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_wombat_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured-tomato-heron (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_heron_z3n (npm)
1 compromised version
Page 456 of 7,327