Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,270 total · sorted newest first- Aug 14, 2025
Malicious code in jblank (npm)
- Aug 14, 2025
Malicious code in jb-abtest (npm)
- Aug 14, 2025
Malicious code in jayparser (npm)
- Aug 14, 2025
Malicious code in jaynan (npm)
- Aug 14, 2025
Malicious code in jaydocs (npm)
- Aug 14, 2025
Malicious code in jayaff (npm)
- Aug 14, 2025
Malicious code in jaxproc (npm)
- Aug 14, 2025
Malicious code in jawema (npm)
- Aug 14, 2025
Malicious code in javauto (npm)
- Aug 14, 2025
Malicious code in javatres (npm)
- Aug 14, 2025
Malicious code in javastoreid (npm)
- Aug 14, 2025
Malicious code in javasite (npm)
- Aug 14, 2025
Malicious code in javashop (npm)
- Aug 14, 2025
Malicious code in javascript3030 (npm)
- Aug 14, 2025
Malicious code in javascript-xenos-rigel-izar (npm)
- Aug 14, 2025
Malicious code in javascript-radioastronomy-morgan-carina (npm)
- Aug 14, 2025
Malicious code in javascript-protoplanetarydisk-yakutsk-string (npm)
- Aug 14, 2025
Malicious code in javascript-package-kaus-xml (npm)
- Aug 14, 2025
Malicious code in javascript-outercore-scripts-gridsome (npm)
- Aug 14, 2025
Malicious code in javascript-nightmare-jekyll-postcss-loader (npm)
- Aug 14, 2025
Malicious code in javascript-msx-sdk (npm)
- Aug 14, 2025
Malicious code in javascript-astrochemistry-panspermia-mongoose (npm)
- Aug 14, 2025
Malicious code in javarepo (npm)
- Aug 14, 2025
Malicious code in javarat (npm)
- Aug 14, 2025
Malicious code in javapong (npm)
- Aug 14, 2025
Malicious code in javapay (npm)
- Aug 14, 2025
Malicious code in javaodev (npm)
- Aug 14, 2025
Malicious code in javagift (npm)
- Aug 14, 2025
Malicious code in javagames (npm)
- Aug 14, 2025
Malicious code in javacuda (npm)
- Aug 14, 2025
Malicious code in java-validate-monitor-link-private (npm)
- Aug 14, 2025
Malicious code in java-fork-byte-double-epsilon (npm)
- Aug 14, 2025
Malicious code in jaticker (npm)
- Aug 14, 2025
Malicious code in jaspilite (npm)
- Aug 14, 2025
Malicious code in jasper-yzxyc-s87r4-star-project (npm)
- Aug 14, 2025
Malicious code in jasper-repository (npm)
- Aug 14, 2025
Malicious code in jasper-qopud-py5vt-paradise-project (npm)
- Aug 14, 2025
Malicious code in jasper-fj3y3-aiha8-orbit-project (npm)
- Aug 14, 2025
Malicious code in jasper-avbkv-p4win-lavender-project (npm)
- Aug 14, 2025
Malicious code in jasper-95fp6-txeo1-xenith-project (npm)
- Aug 14, 2025
Malicious code in jasper-6rm7t-t2w99-solace-project (npm)
- Aug 14, 2025
Malicious code in jasper-43bbw-2obmm-vortex-project (npm)
- Aug 14, 2025
Malicious code in jasmine_smycx_tjmmc_cascade (npm)
- Aug 14, 2025
Malicious code in jasmine_igjpe_a7kgl_arcade (npm)
- Aug 14, 2025
Malicious code in jasmine_i4oid_q9bdd_dawn (npm)
- Aug 14, 2025
Malicious code in jasmine_a9gho_9fr2f_drizzle (npm)
- Aug 14, 2025
Malicious code in jasmine_9nnaq_beblx_ember (npm)
- Aug 14, 2025
Malicious code in jasmine_1u5ay_6cqvo_aroma (npm)
- Aug 14, 2025
Malicious code in jasmine-xanadu-law175-project (npm)
- Aug 14, 2025
Malicious code in jasmine-whirlpool-wbx348-project (npm)
Page 5980 of 7,326