Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,383 total · sorted newest first- Sep 13, 2026
Malicious code in icha-69 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-73 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-63 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-81 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-80 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-6 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-64 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-66 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-75 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-79 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-57 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-62 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-68 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-70 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-78 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-8 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-60 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-82 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-7 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-76 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-72 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-58 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-54 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-48 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-45 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-49 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-40 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-4 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-52 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-41 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-47 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-50 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-56 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-39 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-55 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-53 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-42 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-43 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-46 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-5 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-51 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-44 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-20 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-30 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-19 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-36 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-21 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-31 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-33 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-16 (npm)
1 compromised version
Page 533 of 7,328