Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,337 total · sorted newest first- Sep 13, 2026
Malicious code in init-optimize-css-assets-webpack-plugin-nodejs-grus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in initial_mackerel_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-dione-server-pegasus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-ignite-weywot-webpack (npm)
1 compromised version
- Sep 13, 2026
Malicious code in injured-orange-sturgeon (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-writable-pino-semantic-release (npm)
1 compromised version
- Sep 13, 2026
Malicious code in initial_skink_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-venus-sync-figures (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-postcss-markdown-pdf-sequelize (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-mui-exobiology-local (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-ora-cypress-sails (npm)
1 compromised version
- Sep 13, 2026
Malicious code in initial_hornet_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-solis-gravity-proxima (npm)
1 compromised version
- Sep 13, 2026
Malicious code in initial-red-mandrill (npm)
1 compromised version
- Sep 13, 2026
Malicious code in initial-beige-leech (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-hugo-markdownlint-hydra (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-wezen-umbriel-hyperion (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-rest-xenos-fork (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-halley-non-blocking-frontend (npm)
1 compromised version
- Sep 13, 2026
Malicious code in initial_locust-appteadev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in initial-path32 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-nestjs-loopback-pino (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-quito-farout-non-blocking (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_whitefish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_salmon_dumbs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-middleware-build-xo (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_possum_dumbs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-playwright-kaus-weywot (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-event-carpo-meteor (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-draco-frontend-quark (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-duplex-mini-css-extract-plugin-stream (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_wolf_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-delphinus-fetch-sync (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-xenos-stream-webdriverio (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-lynx-triton-forever (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inicontohrcekak (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-sirius-ursa-prettier-plugin-markdown (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-polaris-levels-iota (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-dactyl-xo-perseus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-koa-adonis-astrometry (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-chalk-cors-colors (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-carpo-kastra-auth0 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-pyxis-arcturus-izar (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-forever-foundation-framework (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_wasp_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-quito-stratosphere-slides (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-envconfig-less-loader-hadron (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_salamander_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-rehype-norma-weywot (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-cypress-celeste-pegasus (npm)
1 compromised version
Page 458 of 7,327