Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,392 total · sorted newest first- Sep 13, 2026
Malicious code in iceberg-almond-jx84 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in iceberg-ihxd3-iw60c-pinnacle-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ice-y9v7e-pjp3g-solace-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke93 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke87 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke89 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icca-core-lib (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke90 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke95 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke97 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke84 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ice-e592h-rted6-jade-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke98 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ice-fnzvy-v1nyz-lunar-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke92 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke83 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke99 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke91 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ice-templates (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke85 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke9 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in icctest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ice-uud8z-um6ib-uplift-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ice-thank-root (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ice-0csyt-uwn4e-xenith-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke94 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke88 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke82 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke86 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke96 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke71 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke61 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke8 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke73 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke81 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke65 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke59 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke7 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke69 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke55 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke57 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke79 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke53 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke60 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke80 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke6 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke62 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke54 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke64 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in ican-poke67 (npm)
1 compromised version
Page 535 of 7,328