Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,276 total · sorted newest first- Aug 14, 2025
Malicious code in json-soap-postcss-tectonic (npm)
- Aug 14, 2025
Malicious code in json-search (npm)
- Aug 14, 2025
Malicious code in json-resources (npm)
- Aug 14, 2025
Malicious code in json-perseus-package-ursa (npm)
- Aug 14, 2025
Malicious code in json-packet-parser (npm)
- Aug 14, 2025
Malicious code in json-language-server (npm)
- Aug 14, 2025
Malicious code in json-juno-pegasus-ursa (npm)
- Aug 14, 2025
Malicious code in json-configs (npm)
- Aug 14, 2025
Malicious code in jsmsha3 (npm)
- Aug 14, 2025
Malicious code in jsii-calc (npm)
- Aug 14, 2025
Malicious code in jsii-build-tools (npm)
- Aug 14, 2025
Malicious code in jsify (npm)
- Aug 14, 2025
Malicious code in jshydra (npm)
- Aug 14, 2025
Malicious code in jshkrnxbylzdpfqi (npm)
- Aug 14, 2025
Malicious code in jshdate (npm)
- Aug 14, 2025
Malicious code in jshashset (npm)
- Aug 14, 2025
Malicious code in jscourse (npm)
- Aug 14, 2025
Malicious code in jscarton (npm)
- Aug 14, 2025
Malicious code in js3030-week4 (npm)
- Aug 14, 2025
Malicious code in js3030-week3 (npm)
- Aug 14, 2025
Malicious code in js3030-week2 (npm)
- Aug 14, 2025
Malicious code in js3030-week1 (npm)
- Aug 14, 2025
Malicious code in js3030-main (npm)
- Aug 14, 2025
Malicious code in js3030-installation (npm)
- Aug 14, 2025
Malicious code in js-wha3 (npm)
- Aug 14, 2025
Malicious code in js-task-paths (npm)
- Aug 14, 2025
Malicious code in js-sxa3 (npm)
- Aug 14, 2025
Malicious code in js-sla3 (npm)
- Aug 14, 2025
Malicious code in js-sja3 (npm)
- Aug 14, 2025
Malicious code in js-sia3 (npm)
- Aug 14, 2025
Malicious code in js-shq3 (npm)
- Aug 14, 2025
Malicious code in js-shi3 (npm)
- Aug 14, 2025
Malicious code in js-she3 (npm)
- Aug 14, 2025
Malicious code in js-shc3 (npm)
- Aug 14, 2025
Malicious code in js-shas (npm)
- Aug 14, 2025
Malicious code in js-sha7 (npm)
- Aug 14, 2025
Malicious code in js-sequence-diagrams (npm)
- Aug 14, 2025
Malicious code in js-rha3 (npm)
- Aug 14, 2025
Malicious code in js-regular (npm)
- Aug 14, 2025
Malicious code in js-qha3 (npm)
- Aug 14, 2025
Malicious code in js-presets (npm)
- Aug 14, 2025
Malicious code in js-mods (npm)
- Aug 14, 2025
Malicious code in js-donkey (npm)
- Aug 14, 2025
Malicious code in js-cha3 (npm)
- Aug 14, 2025
Malicious code in js-base64-int (npm)
- Aug 14, 2025
Malicious code in js-3ha3 (npm)
- Aug 14, 2025
Malicious code in jrswizzle (npm)
- Aug 14, 2025
Malicious code in jrplidar (npm)
- Aug 14, 2025
Malicious code in jreplay (npm)
- Aug 14, 2025
Malicious code in jreject (npm)
Page 5975 of 7,326