Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,372 total · sorted newest first- Sep 13, 2026
Malicious code in impossible_frog_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_swallow_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_pheasant_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_wolverine-tool (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_ostrich_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_gorilla_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in import-float-omega-user-eta (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_beetle_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_aardvark_scarlet-88 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in importance-cake-felt (npm)
1 compromised version
- Sep 13, 2026
Malicious code in import-proxy-cron-balance-abstract (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_centipede_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in import-process-orchestrate-stub-phi (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_cow_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in import-log-monitor-rho-function (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_chickadee_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in import-omega-long-cloud-gamma (npm)
1 compromised version
- Sep 13, 2026
Malicious code in import-uglify-shell-assert-key (npm)
1 compromised version
- Sep 13, 2026
Malicious code in import-wasm-static (npm)
1 compromised version
- Sep 13, 2026
Malicious code in import-user-reject-decode-async (npm)
1 compromised version
- Sep 13, 2026
Malicious code in import-omega-star-compress-wind (npm)
1 compromised version
- Sep 13, 2026
Malicious code in important_crocodile_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in import-scale-deserialize-sudo-visualize (npm)
1 compromised version
- Sep 13, 2026
Malicious code in implicit_amphibian-apptea (npm)
1 compromised version
- Sep 13, 2026
Malicious code in implicit_beetle_blue-27 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in import-benchmark-warn-node-catch (npm)
1 compromised version
- Sep 13, 2026
Malicious code in implicit_bat_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in implicit_flyingfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in implicit_goose_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in implicit_porcupine_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in implicit-chocolate-worm (npm)
1 compromised version
- Sep 13, 2026
Malicious code in implicit-orange-egret (npm)
1 compromised version
- Sep 13, 2026
Malicious code in implicit_salmon_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in implicit_jackal_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in import-debug-compress-byte-long (npm)
1 compromised version
- Sep 13, 2026
Malicious code in import-compile-compile-bad-report (npm)
1 compromised version
- Sep 13, 2026
Malicious code in implicit_toad_peach-48 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in import-cron-test-decompress-log (npm)
1 compromised version
- Sep 13, 2026
Malicious code in implicit_crocodile_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in implicit_gopher_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in implicit_mouse_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in implicit_pony_requirement (npm)
1 compromised version
- Sep 13, 2026
Malicious code in import-abstract-nu-private-decrypt (npm)
1 compromised version
- Sep 13, 2026
Malicious code in implicit-coffee-quelea (npm)
1 compromised version
- Sep 13, 2026
Malicious code in implicit_firefly_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in implicit_worm_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in implicit-brown-peafowl (npm)
1 compromised version
- Sep 13, 2026
Malicious code in import-big-runtime-permission-web (npm)
1 compromised version
- Sep 13, 2026
Malicious code in impinj-is-tool (npm)
1 compromised version
- Sep 13, 2026
Malicious code in implicit_vicuna_z3n (npm)
1 compromised version
Page 499 of 7,328