Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,392 total · sorted newest first- Sep 13, 2026
Malicious code in icha-44 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-20 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-30 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-19 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-36 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-21 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-31 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-33 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-16 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-3 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-24 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-32 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-25 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-17 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-38 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-18 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-29 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-27 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-28 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-26 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-35 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-34 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-23 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-2 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-37 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-22 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iceberg-larch-813s (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-10 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iceberg-umbrella-ubwk (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icewind (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iceberg-observatory-fud0 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-14 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-100 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-101 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-1 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iceberg-quagmire-xjc232-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iceberg-xylophone-rtu806-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-13 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-11 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iceberg-paradise-fuq126-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-12 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iceberg-j9z4i-is4u2-amber-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iceberg-lct0z-lyaw0-moonlight-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icha-15 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iceberg-qgf3n-qfx04-valley-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icelus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iceberg-grove-wyf494-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iceberg-falcon-vn21 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iceberg-icicle-pip930-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iceberg-gorilla-igfp (npm)
1 compromised version
Page 534 of 7,328