Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,284 total · sorted newest first- Aug 14, 2025
Malicious code in lodsah (npm)
- Aug 14, 2025
Malicious code in lodqwh (npm)
- Aug 14, 2025
Malicious code in lodqsh (npm)
- Aug 14, 2025
Malicious code in lodownryanhanks1106 (npm)
- Aug 14, 2025
Malicious code in lodown-samsung329 (npm)
- Aug 14, 2025
Malicious code in lodassh (npm)
- Aug 14, 2025
Malicious code in lodasn (npm)
- Aug 14, 2025
Malicious code in lodashn (npm)
- Aug 14, 2025
Malicious code in lodashh (npm)
- Aug 14, 2025
Malicious code in lodash_tailwind (npm)
- Aug 14, 2025
Malicious code in lodash.js (npm)
- Aug 14, 2025
Malicious code in lodash-simple (npm)
- Aug 14, 2025
Malicious code in lodash-g (npm)
- Aug 14, 2025
Malicious code in lodash-fast (npm)
- Aug 14, 2025
Malicious code in lodahs (npm)
- Aug 14, 2025
Malicious code in lodah (npm)
- Aug 14, 2025
Malicious code in lodache (npm)
- Aug 14, 2025
Malicious code in locoquizz (npm)
- Aug 14, 2025
Malicious code in loclys-leaflet-routing-machine (npm)
- Aug 14, 2025
Malicious code in locktools (npm)
- Aug 14, 2025
Malicious code in lockheed-react (npm)
- Aug 14, 2025
Malicious code in locker-client-js-manifest (npm)
- Aug 14, 2025
Malicious code in lock-test6035 (npm)
- Aug 14, 2025
Malicious code in locits (npm)
- Aug 14, 2025
Malicious code in locationary (npm)
- Aug 14, 2025
Malicious code in localz-react-native-sdk (npm)
- Aug 14, 2025
Malicious code in localz-lastmile-ui-login (npm)
- Aug 14, 2025
Malicious code in localz-lastmile-react-native-sdk (npm)
- Aug 14, 2025
Malicious code in locale-dev-cdbs (npm)
- Aug 14, 2025
Malicious code in local-terser-wasat-ophiuchus (npm)
- Aug 14, 2025
Malicious code in local-storage-manager-html5 (npm)
- Aug 14, 2025
Malicious code in local-quantumfoam-cypress-cosmology (npm)
- Aug 14, 2025
Malicious code in local-phoebe-soap-react-bootstrap (npm)
- Aug 14, 2025
Malicious code in local-news-stream (npm)
- Aug 14, 2025
Malicious code in local-modules-as-global (npm)
- Aug 14, 2025
Malicious code in local-lds (npm)
- Aug 14, 2025
Malicious code in local-impulse-decoherence-stream (npm)
- Aug 14, 2025
Malicious code in local-dependency (npm)
- Aug 14, 2025
Malicious code in local-debug (npm)
- Aug 14, 2025
Malicious code in lobbying (npm)
- Aug 14, 2025
Malicious code in loan-match-list (npm)
- Aug 14, 2025
Malicious code in loadyaml (npm)
- Aug 14, 2025
Malicious code in loader-8319331108 (npm)
- Aug 14, 2025
Malicious code in load-validate-function-star-execute (npm)
- Aug 14, 2025
Malicious code in load-runtime-benchmark-hash-cluster (npm)
- Aug 14, 2025
Malicious code in load-lambda-fire-code-emulate (npm)
- Aug 14, 2025
Malicious code in load-hot-info-delta-encode (npm)
- Aug 14, 2025
Malicious code in load-cat-container-hot-book (npm)
- Aug 14, 2025
Malicious code in load-book-encrypt-deserialize-permission (npm)
- Aug 14, 2025
Malicious code in lnxqpyseckhfwikg (npm)
Page 5944 of 7,326