Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,276 total · sorted newest first- Aug 14, 2025
Malicious code in juliet-erk-project (npm)
- Aug 14, 2025
Malicious code in juliet-echo-fbqi (npm)
- Aug 14, 2025
Malicious code in juliet-delta-yankee-xihfn (npm)
- Aug 14, 2025
Malicious code in juliet-date-livf (npm)
- Aug 14, 2025
Malicious code in juliet-banana-itqc (npm)
- Aug 14, 2025
Malicious code in juliet-apple-faqu (npm)
- Aug 14, 2025
Malicious code in juliet-9zy-project (npm)
- Aug 14, 2025
Malicious code in juliet-7ih-project (npm)
- Aug 14, 2025
Malicious code in juliet-5vh-project (npm)
- Aug 14, 2025
Malicious code in juliet-2oh-project (npm)
- Aug 14, 2025
Malicious code in juliet-0nj-project (npm)
- Aug 14, 2025
Malicious code in julestext (npm)
- Aug 14, 2025
Malicious code in jukubox (npm)
- Aug 14, 2025
Malicious code in jukepi (npm)
- Aug 14, 2025
Malicious code in juicip (npm)
- Aug 14, 2025
Malicious code in juicer-plugin (npm)
- Aug 14, 2025
Malicious code in juiced (npm)
- Aug 14, 2025
Malicious code in juhuwai (npm)
- Aug 14, 2025
Malicious code in juffer-xor (npm)
- Aug 14, 2025
Malicious code in juetpy (npm)
- Aug 14, 2025
Malicious code in judith-m (npm)
- Aug 14, 2025
Malicious code in judgeme (npm)
- Aug 14, 2025
Malicious code in judejude (npm)
- Aug 14, 2025
Malicious code in jubilee-apple-oki112-project (npm)
- Aug 14, 2025
Malicious code in jtstream (npm)
- Aug 14, 2025
Malicious code in jtr-hbs (npm)
- Aug 14, 2025
Malicious code in jtlibrary (npm)
- Aug 14, 2025
Malicious code in jtgnalkypqrzxhes (npm)
- Aug 14, 2025
Malicious code in jtextgame (npm)
- Aug 14, 2025
Malicious code in jtb-mytrips (npm)
- Aug 14, 2025
Malicious code in jsua-rux (npm)
- Aug 14, 2025
Malicious code in jstoolnpp (npm)
- Aug 14, 2025
Malicious code in jstiuzdorkkfcmxp (npm)
- Aug 14, 2025
Malicious code in jsteward (npm)
- Aug 14, 2025
Malicious code in jsrsasign-browser (npm)
- Aug 14, 2025
Malicious code in jsplc-date (npm)
- Aug 14, 2025
Malicious code in jspeel (npm)
- Aug 14, 2025
Malicious code in jsonweqjoken (npm)
6 compromised versions
- Aug 14, 2025
Malicious code in jsontome (npm)
- Aug 14, 2025
Malicious code in jsonp-testcafe-aether-blazar (npm)
- Aug 14, 2025
Malicious code in jsonp-reveal-md-rollup-plugin-envconfig (npm)
- Aug 14, 2025
Malicious code in jsonp-neptune-neptune-zephyr (npm)
- Aug 14, 2025
Malicious code in jsonp-init-command-bunyan (npm)
- Aug 14, 2025
Malicious code in jsonp-envconfig-betelgeuse-eslint (npm)
- Aug 14, 2025
Malicious code in jsonlift (npm)
- Aug 14, 2025
Malicious code in jsonl10nfilecomparer (npm)
- Aug 14, 2025
Malicious code in jsoncake (npm)
- Aug 14, 2025
Malicious code in jsonbind (npm)
- Aug 14, 2025
Malicious code in json_log_formatter (npm)
- Aug 14, 2025
Malicious code in json9 (npm)
Page 5974 of 7,326