Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in hudctl (npm)
- Aug 14, 2025
Malicious code in hubspawn (npm)
- Aug 14, 2025
Malicious code in hubot-frostedio-env (npm)
- Aug 14, 2025
Malicious code in hubot-factoids-3ch01c (npm)
- Aug 14, 2025
Malicious code in httpunch (npm)
- Aug 14, 2025
Malicious code in httprules (npm)
- Aug 14, 2025
Malicious code in httplistd (npm)
- Aug 14, 2025
Malicious code in httpguide (npm)
- Aug 14, 2025
Malicious code in httpeace-node-plugin-upload (npm)
- Aug 14, 2025
Malicious code in httpeace-node-core (npm)
- Aug 14, 2025
Malicious code in http-promises-async (npm)
- Aug 14, 2025
Malicious code in http-helmet (npm)
- Aug 14, 2025
Malicious code in http-geobase (npm)
- Aug 14, 2025
Malicious code in http (npm)
- Aug 14, 2025
Malicious code in httiyn7n4avhlugd6xvldzgbwpjsrfjp (npm)
- Aug 14, 2025
Malicious code in htrapit (npm)
- Aug 14, 2025
Malicious code in htproject (npm)
- Aug 14, 2025
Malicious code in htmlglue (npm)
- Aug 14, 2025
Malicious code in html5-escape (npm)
- Aug 14, 2025
Malicious code in html2coffeekup-bal (npm)
- Aug 14, 2025
Malicious code in html-webpack-plugin-panspermia-local-tachyon (npm)
- Aug 14, 2025
Malicious code in html-webpack-plugin-odin-jest-transform (npm)
- Aug 14, 2025
Malicious code in html-patcher (npm)
- Aug 14, 2025
Malicious code in hstester (npm)
- Aug 14, 2025
Malicious code in hsrmap (npm)
- Aug 14, 2025
Malicious code in hsreport (npm)
- Aug 14, 2025
Malicious code in hsf-server (npm)
- Aug 14, 2025
Malicious code in hsf-clients (npm)
- Aug 14, 2025
Malicious code in hscday (npm)
- Aug 14, 2025
Malicious code in hsbc-modal (npm)
- Aug 14, 2025
Malicious code in hs_codes (npm)
- Aug 14, 2025
Malicious code in hs-sha3 (npm)
- Aug 14, 2025
Malicious code in hs-api-next-gen (npm)
- Aug 14, 2025
Malicious code in hrodei (npm)
- Aug 14, 2025
Malicious code in hqsql (npm)
- Aug 14, 2025
Malicious code in hqlkgubcovjiskta (npm)
- Aug 14, 2025
Malicious code in hqj0rx (npm)
- Aug 14, 2025
Malicious code in hpygdtsiukcxolvw (npm)
- Aug 14, 2025
Malicious code in hpmm (npm)
- Aug 14, 2025
Malicious code in hpioj5 (npm)
- Aug 14, 2025
Malicious code in hpfeedirc (npm)
- Aug 14, 2025
Malicious code in hp1dma (npm)
- Aug 14, 2025
Malicious code in hp-svc-facs-store (npm)
- Aug 14, 2025
Malicious code in howwrong (npm)
- Aug 14, 2025
Malicious code in how-to-npm-tester-lee (npm)
- Aug 14, 2025
Malicious code in how-to-get-unlimited-coin-master-spins-daily-in-2023-efkedz (npm)
- Aug 14, 2025
Malicious code in how-to-get-free-fortnite-vbucks-2023-zdkdz (npm)
- Aug 14, 2025
Malicious code in how-to-get-free-coin-master-spins-2023-working-and-updated-jjeef (npm)
- Aug 14, 2025
Malicious code in how-to-get-followers-on-instagram-without-following (npm)
- Aug 14, 2025
Malicious code in how-iget-free-fortnite-vbucks-daily-jfkze (npm)
Page 5536 of 6,634