Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,372 total · sorted newest first- Sep 13, 2026
Malicious code in impressive_galliform_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impressive_bandicoot-strongdev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impressive_elephant_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impossible_raccoon_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impressive_haddock_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impressed_rabbit_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impossible_iguana-silentdev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impossible_stoat_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impossible_gull_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impressed-blue-prawn (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impressive-salmon-catshark (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impossible_wallaby_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impressive_bobolink_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impressed_carp-smiletea (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impressive-red-goose (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impressive_giraffe_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_marlin_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_vole_dumbs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_cuckoo_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in import-mysql (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_marsupial_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impossible-aquamarine-cattle (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_wildebeest-appteadev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impossible_bandicoot_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_swordtail_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_peacock_replicate_automation (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_shark_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_quokka_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impossible_dove_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impossible_bobolink_dumbs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_stork_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impossible_aardvark_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impossible-black-herring (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_wildcat_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_wasp_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_toad_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impossible_boar_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_ferret_dumbs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impossible_bird_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impossible-orange-rodent (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impossible-gold-spider (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_mink_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_turkey_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impossible_falcon_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_jellyfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impossible_ferret_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impossible_aardwolf_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_wildfowl_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_spider_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in import-grep-void-await-minify (npm)
1 compromised version
Page 498 of 7,328