Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,355 total in npm · sorted newest first- Aug 14, 2025
Malicious code in @hopper-b2b/uber-iframe (npm)
2 compromised versions
- Aug 14, 2025
Malicious code in @hopper-b2b/hopper (npm)
2 compromised versions
- Aug 14, 2025
Malicious code in @hopper-b2b/flair (npm)
2 compromised versions
- Aug 14, 2025
Malicious code in @hopper-b2b/armario (npm)
2 compromised versions
- Aug 14, 2025
Malicious code in @hmp/testt (npm)
- Aug 14, 2025
Malicious code in @hmp/test (npm)
- Aug 14, 2025
Malicious code in @hishprorg/voluptatum-cupiditate-id (npm)
- Aug 14, 2025
Malicious code in @hishprorg/voluptas-doloribus-eum (npm)
- Aug 14, 2025
Malicious code in @hishprorg/veniam-soluta (npm)
- Aug 14, 2025
Malicious code in @hishprorg/veniam-quasi (npm)
- Aug 14, 2025
Malicious code in @hishprorg/ullam-deserunt-corporis (npm)
- Aug 14, 2025
Malicious code in @hishprorg/special-system (npm)
- Aug 14, 2025
Malicious code in @hishprorg/soluta-ullam (npm)
- Aug 14, 2025
Malicious code in @hishprorg/sint-eos-sit (npm)
- Aug 14, 2025
Malicious code in @hishprorg/sed-quod-necessitatibus (npm)
- Aug 14, 2025
Malicious code in @hishprorg/sed-esse (npm)
- Aug 14, 2025
Malicious code in @hishprorg/repudiandae-officia (npm)
- Aug 14, 2025
Malicious code in @hishprorg/quisquam-aperiam-temporibus (npm)
- Aug 14, 2025
Malicious code in @hishprorg/quas-animi-quam (npm)
- Aug 14, 2025
Malicious code in @hishprorg/placeat-culpa (npm)
- Aug 14, 2025
Malicious code in @hishprorg/perferendis-fuga (npm)
- Aug 14, 2025
Malicious code in @hishprorg/pariatur-neque-incidunt (npm)
- Aug 14, 2025
Malicious code in @hishprorg/optio-incidunt (npm)
- Aug 14, 2025
Malicious code in @hishprorg/omnis-optio (npm)
- Aug 14, 2025
Malicious code in @hishprorg/officiis-quis (npm)
- Aug 14, 2025
Malicious code in @hishprorg/non-atque (npm)
- Aug 14, 2025
Malicious code in @hishprorg/nihil-ab (npm)
- Aug 14, 2025
Malicious code in @hishprorg/nesciunt-harum (npm)
- Aug 14, 2025
Malicious code in @hishprorg/neque-excepturi (npm)
- Aug 14, 2025
Malicious code in @hishprorg/nam-quas (npm)
- Aug 14, 2025
Malicious code in @hishprorg/nam-molestiae-ducimus (npm)
- Aug 14, 2025
Malicious code in @hishprorg/modi-eligendi (npm)
- Aug 14, 2025
Malicious code in @hishprorg/minima-molestiae (npm)
- Aug 14, 2025
Malicious code in @hishprorg/maxime-voluptatum-fugit (npm)
- Aug 14, 2025
Malicious code in @hishprorg/magni-amet-id (npm)
- Aug 14, 2025
Malicious code in @hishprorg/laborum-quo (npm)
- Aug 14, 2025
Malicious code in @hishprorg/laborum-occaecati-itaque (npm)
- Aug 14, 2025
Malicious code in @hishprorg/iure-fuga (npm)
- Aug 14, 2025
Malicious code in @hishprorg/inventore-accusantium (npm)
- Aug 14, 2025
Malicious code in @hishprorg/impedit-reprehenderit-quo (npm)
- Aug 14, 2025
Malicious code in @hishprorg/expedita-quo-accusamus (npm)
- Aug 14, 2025
Malicious code in @hishprorg/exercitationem-ex (npm)
- Aug 14, 2025
Malicious code in @hishprorg/et-pariatur-a (npm)
- Aug 14, 2025
Malicious code in @hishprorg/et-illo (npm)
- Aug 14, 2025
Malicious code in @hishprorg/esse-nam (npm)
- Aug 14, 2025
Malicious code in @hishprorg/error-quod (npm)
- Aug 14, 2025
Malicious code in @hishprorg/eaque-perspiciatis (npm)
- Aug 14, 2025
Malicious code in @hishprorg/ea-excepturi (npm)
- Aug 14, 2025
Malicious code in @hishprorg/dolorum-aut (npm)
- Aug 14, 2025
Malicious code in @hishprorg/doloribus-animi-praesentium (npm)
Page 5178 of 6,668