Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,337 total · sorted newest first- Sep 13, 2026
Malicious code in injured_xerinae_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inland-apricot-puma (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_cobra_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in initial_squid_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inland_cougar_replicate_automation (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_mastodon_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_wallaby_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in initial-yellow-impala (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_urial_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_cat-strongdev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_lark_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_dormouse_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_dragonfly_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_starfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_leech_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_planarian-smiletea (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_angelfish-silentdev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inland_canid_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injected-curltest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in initial_otter_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_beetle-appteadev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inland_crow_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_ermine-apptea (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured_opossum_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-gemini-cassini-warp (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-subscription-callisto-europa (npm)
1 compromised version
- Sep 13, 2026
Malicious code in initial_galliform_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-rest-sedna-gacrux (npm)
1 compromised version
- Sep 13, 2026
Malicious code in initial-purple-toad (npm)
1 compromised version
- Sep 13, 2026
Malicious code in initial_dolphin_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in initial-indigo-dingo (npm)
1 compromised version
- Sep 13, 2026
Malicious code in initial_catshark_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in initial_rodent_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-publish-boson-apex (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injectapp-org-injection-of-apps-and-news900 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in initial_dormouse_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-parcel-run-script-hugo (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-router (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-yildun-proxima-async (npm)
1 compromised version
- Sep 13, 2026
Malicious code in initial-tomato-cardinal (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-kastra-leda-canopus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-enceladus-quark-terraforming (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-enceladus-magnetosphere-registry (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-titan-rollup-sagitta (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-europa-cressida-yonder (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-gulp-eslint-config-thuban (npm)
1 compromised version
- Sep 13, 2026
Malicious code in initial-path21 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-xenos-forever-grus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injectorpackage (npm)
1 compromised version
- Sep 13, 2026
Malicious code in initial-app (npm)
1 compromised version
Page 457 of 7,327