Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,367 total · sorted newest first- Sep 13, 2026
Malicious code in independent_pheasant_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in index-short-java-phi-virtualize (npm)
1 compromised version
- Sep 13, 2026
Malicious code in index-gamma-await-sanitize-private (npm)
1 compromised version
- Sep 13, 2026
Malicious code in index-load-rain-gamma-log (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indexa-fotio-agv (npm)
1 compromised version
- Sep 13, 2026
Malicious code in india-8ep-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indeedblog (npm)
1 compromised version
- Sep 13, 2026
Malicious code in index-template-lol (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent_cougar_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indexa-fotdio-agv (npm)
1 compromised version
- Sep 13, 2026
Malicious code in index-gamma-authorize-deploy-async (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent_echidna_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent_grasshopper_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent_elephant_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent_clownfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent_peafowl_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent_chameleon_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent_chicken_requirement (npm)
1 compromised version
- Sep 13, 2026
Malicious code in index-template-mets (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indexhtml-cli (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent_hamster_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent_grasshopper_indigo-56 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent_hawk_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indexhtml (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indexa-fotadio-agov (npm)
1 compromised version
- Sep 13, 2026
Malicious code in index-grid-unix-long-kappa (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent-silver-turtle (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent_haddock_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in india-9k4-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent_chipmunk_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent_limpet_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent_kingfisher_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indentui (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent_cockroach_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent_canidae_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in index-wind-info-emulate-fork (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indea-fotdio-agov (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent_alpaca-appteadev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent_galliform_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in index.marko (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent_tortoise_crimson-57 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in index-error-cold-earth-encode (npm)
1 compromised version
- Sep 13, 2026
Malicious code in index-chi-grep-nu-wind (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent_giraffe_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent_junglefowl-strongdev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in independent_dingo_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indea-fodioj-agafafba (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indea-fodioj-agaafba (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indea-fodioj-aganafau (npm)
1 compromised version
- Sep 13, 2026
Malicious code in indah-tumis19-breki (npm)
1 compromised version
Page 468 of 7,328