Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,337 total · sorted newest first- Sep 13, 2026
Malicious code in ini-carpo-async-unuk (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-cosmos-corvus-pavo (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-bootes-radiant-aether (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_warbler_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-vuetify-test-chakra-ui (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-release-it-pyxis-auriga (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-rigel-framework-helmet (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-puppeteer-sirius-heka (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-apex-ursa-gemini (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-passport-quito-mongoose (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inhunmi (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-query-bellatrix-quark (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-antares-deneb-orbit (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-charon-terser-upgrade (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-neptune-mongodb-mensa (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-supervisor-ini-enif (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_puma_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-pulsar-cross-env-quantum (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_swordfish_requirement (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-nodejs-speleology-filament (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-barnard-juno-shelljs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-tailwindcss-playwright-nova (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-mongodb-got-socketio (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-event-dependencies-umbriel (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-wasat-react-bootstrap-javascript (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-arcturus-native-server (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-cors-barnard-xerxes (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-development-barnard-telesto (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-rollup-plugin-gulp-semantic-ui (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-meissa-taurus-avior (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent-crimson-mandrill (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ing-feat-mortgage-consent-starter (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_narwhal_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ing-feat-lu-luxtrust-smartcard-authentication (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_goldfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in infrastructure-lib (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent-emerald-caribou (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_harrier_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ing-feat-lu-luxtrust-token-authentication (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent-coffee-gamefowl (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent-magenta-cephalopod (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ing-feat-grants-granting (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_pig_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ingka-test (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_lemming_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_cougar_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_marmot-toolteadev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in infrated (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_gull_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ing-shared-navigation-de (npm)
1 compromised version
Page 459 of 7,327