Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,657 total in npm · sorted newest first- Nov 13, 2025
Malicious code in hot-thread-cold-fast-epsilon (npm)
- Nov 13, 2025
Malicious code in hot-float-moon-unix-fork (npm)
- Nov 13, 2025
Malicious code in hot-awk-authorize-float-interface (npm)
- Nov 13, 2025
Malicious code in holography-hercules-janus-postcss (npm)
- Nov 13, 2025
Malicious code in holography-development-nightmare-uranology (npm)
- Nov 13, 2025
Malicious code in holography-commitlint-xml-unuk (npm)
- Nov 13, 2025
Malicious code in holography-commitizen-kardashevscale-morgan (npm)
- Nov 13, 2025
Malicious code in holography-antares-enif-callback (npm)
- Nov 13, 2025
Malicious code in hologram-oscillation-config-nestjs (npm)
- Nov 13, 2025
Malicious code in hologram-jekyll-radiometric-bellatrix (npm)
- Nov 13, 2025
Malicious code in higgs-markdown-pdf-kaus-helmet (npm)
- Nov 13, 2025
Malicious code in higgs-ichnology-paleoceanography-pm2 (npm)
- Nov 13, 2025
Malicious code in higgs-commitizen-aether-archaeogenetics (npm)
- Nov 13, 2025
Malicious code in higgs-biosignature-inflation-upgrade (npm)
- Nov 13, 2025
Malicious code in hexo-steganography-cli-standard (npm)
- Nov 13, 2025
Malicious code in hexo-restart-farout-sync (npm)
- Nov 13, 2025
Malicious code in hexo-publish-hexo-xo (npm)
- Nov 13, 2025
Malicious code in hexo-phenomic-odin-element-ui (npm)
- Nov 13, 2025
Malicious code in hexo-interstellarmedium-spinner-less (npm)
- Nov 13, 2025
Malicious code in hexo-duplex-xenos-bootstrap (npm)
- Nov 13, 2025
Malicious code in hexo-commitlint-config-angular-nuxtjs-neptune (npm)
- Nov 13, 2025
Malicious code in hexo-boson-charon-framework (npm)
- Nov 13, 2025
Malicious code in hermes-websockets-arcturus-meteor (npm)
- Nov 13, 2025
Malicious code in hermes-version-mdx-yaml (npm)
- Nov 13, 2025
Malicious code in hermes-venus-cosmos-rest (npm)
- Nov 13, 2025
Malicious code in hermes-polaris-regulus-apollo (npm)
- Nov 13, 2025
Malicious code in hermes-jekyll-io-nightwatch (npm)
- Nov 13, 2025
Malicious code in hermes-dactyl-canopus-flare (npm)
- Nov 13, 2025
Malicious code in hermes-config-unuk-aurora (npm)
- Nov 13, 2025
Malicious code in hermes-child-process-apex-centauri (npm)
- Nov 13, 2025
Malicious code in hermes-browserify-alphard-greatfilter (npm)
- Nov 13, 2025
Malicious code in hercules-winston-janus-miranda (npm)
- Nov 13, 2025
Malicious code in hercules-radiant-jekyll-delphinus (npm)
- Nov 13, 2025
Malicious code in hercules-pyxis-rehype-hermes (npm)
- Nov 13, 2025
Malicious code in hercules-local-ceres-backend (npm)
- Nov 13, 2025
Malicious code in hercules-fermion-hyperion-version (npm)
- Nov 13, 2025
Malicious code in hercules-deimos-superagent-webdriverio (npm)
- Nov 13, 2025
Malicious code in hercules-css-minimizer-webpack-plugin-cz-conventional-changelog-dorado (npm)
- Nov 13, 2025
Malicious code in hercules-css-loader-restart-eslint-plugin (npm)
- Nov 13, 2025
Malicious code in hercules-config-juno-void (npm)
- Nov 13, 2025
Malicious code in helmet-terser-isostasy-nova (npm)
- Nov 13, 2025
Malicious code in helmet-supercluster-release-it-technosignature (npm)
- Nov 13, 2025
Malicious code in helmet-sirius-ini-mocha (npm)
- Nov 13, 2025
Malicious code in helmet-sagitta-saturnology-element-ui (npm)
- Nov 13, 2025
Malicious code in helmet-release-it-enceladus-figures (npm)
- Nov 13, 2025
Malicious code in helmet-radiant-babel-dorado (npm)
- Nov 13, 2025
Malicious code in helmet-pegasus-non-blocking-phoebe (npm)
- Nov 13, 2025
Malicious code in helmet-neutronstar-xo-xerxes (npm)
- Nov 13, 2025
Malicious code in helmet-geochronology-rigel-sails (npm)
- Nov 13, 2025
Malicious code in helmet-blitz-izar-update (npm)
Page 336 of 4,814