Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,366 total · sorted newest first- Sep 13, 2026
Malicious code in ini-tailwindcss-playwright-nova (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-mongodb-got-socketio (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-event-dependencies-umbriel (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-wasat-react-bootstrap-javascript (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-arcturus-native-server (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-cors-barnard-xerxes (npm)
1 compromised version
- Sep 13, 2026
Malicious code in init-development-barnard-telesto (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-rollup-plugin-gulp-semantic-ui (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ini-meissa-taurus-avior (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent-crimson-mandrill (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ing-feat-mortgage-consent-starter (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_narwhal_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ing-feat-lu-luxtrust-smartcard-authentication (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_goldfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in infrastructure-lib (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent-emerald-caribou (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_harrier_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ing-feat-lu-luxtrust-token-authentication (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent-coffee-gamefowl (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent-magenta-cephalopod (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ing-feat-grants-granting (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_pig_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ingka-test (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_lemming_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_cougar_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_marmot-toolteadev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in infrated (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_gull_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ing-shared-navigation-de (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_chipmunk_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ing-ideal-acquiring-shared (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_catfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ing-lib-lease-calculator (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ing-feat-business-lending-financieringscheck (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ing-feat-pis-single-payments (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ingi-gotvama-anbi (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ing-shared-navigation (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ing-feat-business-intermediary-lease-calculator (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ing-feat-lu-luxtrust-scan-authentication (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ing-feat-lu-luxtrust-stick-authentication (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inherent_junglefowl_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ing-util-analytics6 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ing-feat-uilib-de (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ingest-demo (npm)
1 compromised version
- Sep 13, 2026
Malicious code in informal-harlequin-landfowl (npm)
1 compromised version
- Sep 13, 2026
Malicious code in infowrap-filepicker (npm)
1 compromised version
- Sep 13, 2026
Malicious code in informal-aquamarine-lamprey (npm)
1 compromised version
- Sep 13, 2026
Malicious code in informal_parrot_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in informal-teal-cicada (npm)
1 compromised version
- Sep 13, 2026
Malicious code in informal_puma_z3n (npm)
1 compromised version
Page 460 of 7,328