Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,408 total · sorted newest first- Sep 13, 2026
Malicious code in hyperion-concurrently-photon-metabolomics (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hyperion-auriga-mensa-process (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hyperion-baryon-fork-graphql (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hypc (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydrogeology-darkmatter-achernar-inquirer (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydrogeology-mesosphere-event-troposphere (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hyeonhau (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hyperion-blaze-acamar-equinox (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydrogeology-primatology-galaxy-astrophysics (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydrogeology-event-wezen-eris (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hyperion-build-style-loader-lynx (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydrogeology-hydra-phoenix-fornax (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hyperion-despina-process-loopback (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hyperion-aldebaran-node-config-cross-env (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydrogeology-public-hapi-bootes (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hyperion-bellatrix-carina-carpo (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hyperion-capella-auth0-planetology (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hyperion-autologging (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydrogeology-antares-hydrogeology-chromedriver (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hyperion-dependencies-query-castor (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hyperion-buffer-centauri-express (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hyiot-module (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hyperion-auth-concurrently-request (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydrogen-react (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-regulus-wavefunction-spectron (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-hermes-ichnology-ariel (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-semantic-release-flare-mutation (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-xanadu-yildun-csrf (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-markdown-pdf-resolvers-postcss (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-hawkingradiation-markdownlint-mini-css-extract-plugin (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-stream-express-lynx (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-rollup-kuiperbelt-node-sass (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-node-consent-sdk (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-iota-metalsmith-dotenv-safe (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-standard-dependencies-fornax (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-postcss-heka-rigel (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-hermes-weywot-hercules (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-publish-filament-prettier-plugin-markdown (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-uninstall-cli-pyxis (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-magellan-forever-astro (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-rigel-eris-module (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-pipe-lint-yonder (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-socketio-fornax-firebase (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-sails-jekyll-pm2 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-neptune-ursa-jest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-wasat-venus-ini (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-private-quantum-test (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-rimraf-apollo-gacrux (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-ora-npm-nashira (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-lepton-interstellarmedium-entanglement (npm)
1 compromised version
Page 541 of 7,329