Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,355 total in npm · sorted newest first- Aug 14, 2025
Malicious code in @hishprorg/dolorem-eligendi-reiciendis (npm)
- Aug 14, 2025
Malicious code in @hishprorg/dolore-nam (npm)
- Aug 14, 2025
Malicious code in @hishprorg/deserunt-sequi-ex (npm)
- Aug 14, 2025
Malicious code in @hishprorg/deserunt-et (npm)
- Aug 14, 2025
Malicious code in @hishprorg/corrupti-dolores (npm)
- Aug 14, 2025
Malicious code in @hishprorg/blanditiis-tenetur (npm)
- Aug 14, 2025
Malicious code in @hishprorg/assumenda-tempora-eius (npm)
- Aug 14, 2025
Malicious code in @hishprorg/aperiam-deleniti (npm)
- Aug 14, 2025
Malicious code in @hishprorg/aliquid-et (npm)
- Aug 14, 2025
Malicious code in @hishprorg/alias-a-unde (npm)
- Aug 14, 2025
Malicious code in @hishprorg/adipisci-itaque (npm)
- Aug 14, 2025
Malicious code in @hishprorg/accusantium-ratione (npm)
- Aug 14, 2025
Malicious code in @hishprorg/a-placeat (npm)
- Aug 14, 2025
Malicious code in @hishpr/vel-nulla-eos-voluptatum (npm)
- Aug 14, 2025
Malicious code in @hishpr/quidem-harum-alias-natus (npm)
- Aug 14, 2025
Malicious code in @hishpr/mollitia-sequi-ut-nulla (npm)
- Aug 14, 2025
Malicious code in @hishpr/in-beatae-quae-occaecati (npm)
- Aug 14, 2025
Malicious code in @hishpr/explicabo-ab-dolor-accusamus (npm)
- Aug 14, 2025
Malicious code in @hishpr/expedita-consequuntur-deleniti-doloribus (npm)
- Aug 14, 2025
Malicious code in @hishpr/excepturi-beatae-at-inventore (npm)
- Aug 14, 2025
Malicious code in @hishpr/eius-amet-perspiciatis-atque (npm)
- Aug 14, 2025
Malicious code in @hishpr/architecto-dolores-molestiae-at (npm)
- Aug 14, 2025
Malicious code in @hishpr/adipisci-rerum-repudiandae-eligendi (npm)
- Aug 14, 2025
Malicious code in @hishpr/a-nesciunt-iusto-illo (npm)
- Aug 14, 2025
Malicious code in @hey-amplify/scripts (npm)
- Aug 14, 2025
Malicious code in @help_center/utilities (npm)
- Aug 14, 2025
Malicious code in @help_center/types (npm)
- Aug 14, 2025
Malicious code in @help_center/modules (npm)
- Aug 14, 2025
Malicious code in @help_center/config (npm)
- Aug 14, 2025
Malicious code in @help_api/utilities (npm)
- Aug 14, 2025
Malicious code in @help_api/types (npm)
- Aug 14, 2025
Malicious code in @help_api/modules (npm)
- Aug 14, 2025
Malicious code in @help_api/config (npm)
- Aug 14, 2025
Malicious code in @healthbyro/design-tokens (npm)
- Aug 14, 2025
Malicious code in @gs-ux-uitoolkit-angular/d3-chart (npm)
- Aug 14, 2025
Malicious code in @ginger-team/public-ui (npm)
- Aug 14, 2025
Malicious code in @ginger-team/payment-form (npm)
- Aug 14, 2025
Malicious code in @ginger-team/billing-notifications (npm)
- Aug 14, 2025
Malicious code in @ginger-dev/test-utils (npm)
- Aug 14, 2025
Malicious code in @ginger-dev/eslint-config (npm)
- Aug 14, 2025
Malicious code in @ginger-dev/create (npm)
- Aug 14, 2025
Malicious code in @funnel-analysis/isengard-client (npm)
- Aug 14, 2025
Malicious code in @frozen-ui/utils (npm)
- Aug 14, 2025
Malicious code in @frozen-ui/tooltip (npm)
- Aug 14, 2025
Malicious code in @frozen-ui/testing-utils (npm)
- Aug 14, 2025
Malicious code in @frozen-ui/snapshot-serializer (npm)
- Aug 14, 2025
Malicious code in @frozen-ui/sm2 (npm)
- Aug 14, 2025
Malicious code in @frozen-ui/picker (npm)
- Aug 14, 2025
Malicious code in @frozen-ui/link-button (npm)
- Aug 14, 2025
Malicious code in @frozen-ui/intergalactic-migrate-for-package (npm)
Page 5179 of 6,668