Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in hhotel (npm)
- Aug 14, 2025
Malicious code in hhjslib (npm)
- Aug 14, 2025
Malicious code in hgfiuythdjfhgff (npm)
- Aug 14, 2025
Malicious code in hfwehew (npm)
- Aug 14, 2025
Malicious code in hfjh5sm3jihqkc1toapmcrfkma08ki46 (npm)
- Aug 14, 2025
Malicious code in hfexcjvbsimukypz (npm)
- Aug 14, 2025
Malicious code in heyhamont (npm)
- Aug 14, 2025
Malicious code in hextest (npm)
- Aug 14, 2025
Malicious code in hexpacker (npm)
- Aug 14, 2025
Malicious code in hexo-iota-betelgeuse-development (npm)
- Aug 14, 2025
Malicious code in hexo-fermion-holography-quasarjet (npm)
- Aug 14, 2025
Malicious code in hexo-cluster-steganography-jsonp (npm)
- Aug 14, 2025
Malicious code in hexkits (npm)
- Aug 14, 2025
Malicious code in hexarobot (npm)
- Aug 14, 2025
Malicious code in hexapong (npm)
- Aug 14, 2025
Malicious code in hexagone (npm)
- Aug 14, 2025
Malicious code in hexabump (npm)
- Aug 14, 2025
Malicious code in hewotuan (npm)
- Aug 14, 2025
Malicious code in hevajra (npm)
- Aug 14, 2025
Malicious code in heumon (npm)
- Aug 14, 2025
Malicious code in hesseso (npm)
- Aug 14, 2025
Malicious code in herotale (npm)
- Aug 14, 2025
Malicious code in herokuup (npm)
- Aug 14, 2025
Malicious code in herokupy (npm)
- Aug 14, 2025
Malicious code in heroku-sudo (npm)
- Aug 14, 2025
Malicious code in hermes-paleontology-taurus-wavefunction (npm)
- Aug 14, 2025
Malicious code in hermes-orbit-eslint-config-comet (npm)
- Aug 14, 2025
Malicious code in hermes-fornax-typeorm-shelljs (npm)
- Aug 14, 2025
Malicious code in hermes-epimetheus-meteor-commitlint (npm)
- Aug 14, 2025
Malicious code in hermes-celeste-react-bootstrap-nodejs (npm)
- Aug 14, 2025
Malicious code in herkcoin (npm)
- Aug 14, 2025
Malicious code in hereaccount-nodejs (npm)
- Aug 14, 2025
Malicious code in herdit (npm)
- Aug 14, 2025
Malicious code in hercules-changelog-tectonic-restart (npm)
- Aug 14, 2025
Malicious code in hercules-centaurus-oberon-sync (npm)
- Aug 14, 2025
Malicious code in hercules-build-metalsmith-graviton (npm)
- Aug 14, 2025
Malicious code in heqetlabs (npm)
- Aug 14, 2025
Malicious code in hendra-taiwan91-sukiwir (npm)
- Aug 14, 2025
Malicious code in hendra-semur33-breki (npm)
- Aug 14, 2025
Malicious code in hendra-saguer49-breki (npm)
- Aug 14, 2025
Malicious code in hendra-miemee87-breki (npm)
- Aug 14, 2025
Malicious code in hendra-brengkes62-breki (npm)
- Aug 14, 2025
Malicious code in hemnet (npm)
- Aug 14, 2025
Malicious code in helptools (npm)
- Aug 14, 2025
Malicious code in helptml (npm)
- Aug 14, 2025
Malicious code in helowrold (npm)
- Aug 14, 2025
Malicious code in helmet-spectroscopy-nucleosynthesis-jsonp (npm)
- Aug 14, 2025
Malicious code in helmet-lepton-baryon-gravitationalwave (npm)
- Aug 14, 2025
Malicious code in helmet-framework-concurrently-jovian (npm)
- Aug 14, 2025
Malicious code in helmet-bellatrix-kastra-pulsar (npm)
Page 5543 of 6,634