Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,367 total · sorted newest first- Sep 13, 2026
Malicious code in individual-moccasin-crow (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indus-apex-spawn-europa (npm)
1 compromised version
- Sep 13, 2026
Malicious code in individual_albatross_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_unicorn_dumbs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_swordtail_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in individual-harlequin-puffin (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_guppy_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indizio (npm)
1 compromised version
- Sep 13, 2026
Malicious code in individual_warbler_dumbs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in individual_koala_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_crane-notthedev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in individual_crocodile_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indukhanna (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_warbler_scarlet-18 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in individual-violet-firefly (npm)
1 compromised version
- Sep 13, 2026
Malicious code in individual_woodpecker_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indigo_z3u10_4rpwx_vista (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect-yellow-sheep (npm)
1 compromised version
- Sep 13, 2026
Malicious code in india-to8-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in india-xigua-mojx (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indigo_qzrd8_rr7y6_driftwood (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indigoeln (npm)
1 compromised version
- Sep 13, 2026
Malicious code in india-u7j-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect-aqua-planarian (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indigo_ngdyn_cwmlg_crown (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indigo_rgiqq_vnnwe_glacier (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indigo_atzug_mqey4_lunar (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_capybara-apptea (npm)
1 compromised version
- Sep 13, 2026
Malicious code in india-strawberry-banana-vqdib (npm)
1 compromised version
- Sep 13, 2026
Malicious code in india-strawberry-hotel-isgee (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_boa_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in india-tangerine-tygs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in india-uniform-idtv (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_chicken_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in india-ugli-akih (npm)
1 compromised version
- Sep 13, 2026
Malicious code in india-xyb-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indigo_vfsca_sg7uv_willow (npm)
1 compromised version
- Sep 13, 2026
Malicious code in india-xigua-grape-fsony (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_cockroach_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect-turquoise-heron (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indigo-wbimi-zf1d4-vortex-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indigo-lrk6k-y1ei4-nova-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in india-strawberry-yam-fhydd (npm)
1 compromised version
- Sep 13, 2026
Malicious code in india-underpass-cna5 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indigo_02i5p_kkrqj_xylophone (npm)
1 compromised version
- Sep 13, 2026
Malicious code in india-yankee-wnki (npm)
1 compromised version
- Sep 13, 2026
Malicious code in india-tangerine-vcki (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indicia1628 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in india-vanilla-kuqz (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indirect_booby_z3n (npm)
1 compromised version
Page 466 of 7,328