Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,276 total · sorted newest first- Aug 14, 2025
Malicious code in kafka-client-ruby (npm)
- Aug 14, 2025
Malicious code in kaerwzyhlkngvxic (npm)
- Aug 14, 2025
Malicious code in kadummy (npm)
- Aug 14, 2025
Malicious code in kachbis (npm)
- Aug 14, 2025
Malicious code in kabusaku (npm)
- Aug 14, 2025
Malicious code in kaascript (npm)
- Aug 14, 2025
Malicious code in kaargo (npm)
- Aug 14, 2025
Malicious code in k8s_ci (npm)
- Aug 14, 2025
Malicious code in k8s-template-validator (npm)
- Aug 14, 2025
Malicious code in k8s-ssdeployer (npm)
- Aug 14, 2025
Malicious code in k8s-image-extractor (npm)
- Aug 14, 2025
Malicious code in k3npj1 (npm)
- Aug 14, 2025
Malicious code in k0a_multer (npm)
- Aug 14, 2025
Malicious code in jzltdokrbsnxpvmi (npm)
- Aug 14, 2025
Malicious code in jyuaxotnvldismzc (npm)
- Aug 14, 2025
Malicious code in jylcutigknzmdbhf (npm)
- Aug 14, 2025
Malicious code in jyhmpldxkbvgruia (npm)
- Aug 14, 2025
Malicious code in jygsaw (npm)
- Aug 14, 2025
Malicious code in jyblog (npm)
- Aug 14, 2025
Malicious code in jwt-webpack-procyon-thuban (npm)
- Aug 14, 2025
Malicious code in jwt-toml-leda-despina (npm)
- Aug 14, 2025
Malicious code in jwt-technocracy-envconfig-venus (npm)
- Aug 14, 2025
Malicious code in jwt-on-superagent-ora (npm)
- Aug 14, 2025
Malicious code in jwt-mongodb-nestjs-gacrux (npm)
- Aug 14, 2025
Malicious code in jwt-module-pipe-chalk (npm)
- Aug 14, 2025
Malicious code in jwt-convict-dependencies-resolvers (npm)
- Aug 14, 2025
Malicious code in jwt-andromeda-eridanus-bellatrix (npm)
- Aug 14, 2025
Malicious code in jwnkqtsfmkbxvrge (npm)
- Aug 14, 2025
Malicious code in jwaves (npm)
- Aug 14, 2025
Malicious code in jw2s1s (npm)
- Aug 14, 2025
Malicious code in jw-sha3 (npm)
- Aug 14, 2025
Malicious code in jvxizlbedrwafkos (npm)
- Aug 14, 2025
Malicious code in jvkwhguyilsdpntq (npm)
- Aug 14, 2025
Malicious code in juvoft (npm)
- Aug 14, 2025
Malicious code in justtestasa (npm)
- Aug 14, 2025
Malicious code in justsite (npm)
- Aug 14, 2025
Malicious code in justingia (npm)
- Aug 14, 2025
Malicious code in justaexpformyself (npm)
- Aug 14, 2025
Malicious code in just-the-docs (npm)
- Aug 14, 2025
Malicious code in just-next-tick (npm)
- Aug 14, 2025
Malicious code in just-function-partial (npm)
- Aug 14, 2025
Malicious code in just-function-curry (npm)
- Aug 14, 2025
Malicious code in just-function-compose (npm)
- Aug 14, 2025
Malicious code in just-array-unique (npm)
- Aug 14, 2025
Malicious code in just-array-union (npm)
- Aug 14, 2025
Malicious code in just-array-remove (npm)
- Aug 14, 2025
Malicious code in just-array-last (npm)
- Aug 14, 2025
Malicious code in just-array-intersect (npm)
- Aug 14, 2025
Malicious code in just-array-flatten (npm)
- Aug 14, 2025
Malicious code in just-a-server (npm)
Page 5971 of 7,326