Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,366 total · sorted newest first- Sep 13, 2026
Malicious code in industrial_wildebeest_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inevitable_magpie-appteadev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inevitable_rabbit_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inevitable_gerbil_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in industrial_hookworm_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in industrial_crane_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inevitable_fly_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inevitable_lungfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in industrial_hedgehog_magenta-31 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inevitable_anaconda_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inevitable_rodent_apricot-59 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inengine (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inevitable_porcupine_rose-85 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in infamy (npm)
1 compromised version
- Sep 13, 2026
Malicious code in industrial_woodpecker_dumbs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in industrial_flea_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in industrial_damselfly_orange-33 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in industrial_narwhal_requirement (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inevitable_swordtail_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in industrial_roundworm_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-vuepress-gravity-electron-builder (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-postgres-avior-node-config (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-resolvers-regulus-mongoose (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-passport-oauth-dotenv-safe (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-relay-nightwatch-google (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-server-eridanus-pino-pretty (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-meissa-jasmine-chai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in industrial-harlequin-spoonbill (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-farout-carpo-astrobiology (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-standard-semantic-release-prompts (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-sagitta-dagda-parcel (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-install-procyon-xenos (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-auth-run-script-capella (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-child-process-apollo-karma (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-fork-rimraf-forever (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-io-prettier-stylelint-cygnus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-transport-chakra-ui-ini (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-triton-polaris-nextjs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in industr (npm)
1 compromised version
- Sep 13, 2026
Malicious code in industrial_bat_requirement (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-mini-css-extract-plugin-mysql-jupiter (npm)
1 compromised version
- Sep 13, 2026
Malicious code in industrial-ivory-python (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-nconf-jekyll-yonder (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-neptune-typeorm-io (npm)
1 compromised version
- Sep 13, 2026
Malicious code in industrial-black-wren (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-hercules-configstore-wezen (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-virgo-publish-taurus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-global-library-parcel (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-optimize-css-assets-webpack-plugin-antd-quasar (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-cybernetics-prettier-plugin-markdown-pavo (npm)
1 compromised version
Page 464 of 7,328