Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,372 total · sorted newest first- Sep 13, 2026
Malicious code in inc_parrotfish-notthedev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inc_canidae_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inc_guan_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inclined_ant_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inc_hedgehog-appteadev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inclined-aquamarine-reindeer (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inc_gazelle_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inclined_prawn_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inc_spider_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inc_zebra_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inclined_puma_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inc_kiwi_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in incendiumrocks (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inclined_earwig_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inclined_nightingale_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inc_barracuda_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inc_llama_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inc_vicuna_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inc_eagle_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inclined_crow_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inclined_sailfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inc_swan_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inc_magenta_shrew-47-tisubasah (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inclined_cardinal_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inc_cougar_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inappropriate-coral-quokka (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inappropriate_sparrow_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inappropriate_dolphin_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inappropriate_stingray_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inappropriate_mink_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inappropriate-lavender-reptile (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inappropriate-white-pheasant (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inappropriate-silver-pelican (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inappropriate_ferret_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inappropriate_tiger_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inc-violet-scorpion (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inappropriate_egret_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inappropriate_guppy_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inappropriate_whale_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inc-tan-primate (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inc_bandicoot_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inappropriate_barracuda_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inappropriate_condor_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inappropriate_herring_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inappropriate_wallaby_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inappropriate_cheetah_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inappropriate_louse_requirement (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inappropriate_gerbil_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inappropriate_yak_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in inc-aquamarine-egret (npm)
1 compromised version
Page 487 of 7,328