Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,367 total · sorted newest first- Sep 13, 2026
Malicious code in indus-cybernetics-prettier-plugin-markdown-pavo (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-coronalmassejection-sass-loader-virgo (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-commitlint-config-angular-cross-env-xanadu (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-elara-selenium-release-it (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-xerxes-hermes-electron (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-callback-achernar-dorado (npm)
1 compromised version
- Sep 13, 2026
Malicious code in industrial_bee_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-perseus-publish-rate-limiter (npm)
1 compromised version
- Sep 13, 2026
Malicious code in industrial_cardinal_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-reveal-md-gulp-neptune (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-bootes-release-it-mui (npm)
1 compromised version
- Sep 13, 2026
Malicious code in individual_frog_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in individual_gibbon_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in individual-cyan-kiwi (npm)
1 compromised version
- Sep 13, 2026
Malicious code in individual_worm-silentdev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in individual_guppy_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in individual_starfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in individual_anglerfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_pigeon_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_yak_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inditextech (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indove-notthedevs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_swift_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in individual-correct-manner (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_deer_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_trout_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in individual-pink-hare (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_lamprey_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_mosquito_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in individual_parrotfish_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_puma_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in individual_galliform_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_squirrel_dumbs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_haddock_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in individual-turquoise-goat (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_mammal_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_lungfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indoorviewer (npm)
1 compromised version
- Sep 13, 2026
Malicious code in individual_chimpanzee_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_falcon_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-astro-materialize-miranda (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-backend-sirius-fusion (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_leopon_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_python_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_galliform_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_reindeer_requirement (npm)
1 compromised version
- Sep 13, 2026
Malicious code in individual_mockingbird_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in individual_fox_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in individual-aquamarine-whale (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indithas-notthedevs (npm)
1 compromised version
Page 465 of 7,328