Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,408 total · sorted newest first- Sep 13, 2026
Malicious code in hydra-pavo-taurus-betelgeuse (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-orogeny-nanotechnology-zenobia (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-helmet-terser-webpack-plugin-ignite (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-consent-app-express (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-command-cz-conventional-changelog-resolvers (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-chalk-io-exec (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hyctymbw (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-hapi-webdriver-manager-async (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-frontend-testcafe-zenith (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-canopus-subscription-fornax (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-equinox-auriga-enif (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-duplex-ursa-less (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-gatsby-fomalhaut-sync (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-bellatrix-backend-sadr (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-browserify-oberon-umbriel (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-betelgeuse-prompts-soap (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-eslint-config-nodejs-triton (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-consent-sdk (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-cryovolcano-darkmatter-quasarjet (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-abiogenesis-auriga-decoherence (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-duplex-npm-ophiuchus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hydra-cressida-wasat-polaris (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hwtbar (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hyatt-album (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hw-webpack-config (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hwieiur (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hybliz (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hx9ehzesmiby2b0bcicrnno9m9l4agzz (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hyatt-avatar (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hwatch (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hw-transition-animation (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hyatt-ui (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hw-tracking (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hwonutkbfeigalqk (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hw-trnasport-u2f (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hwoiers (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hwdong (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hwieuw (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hwoeiw (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hyatt-residential-roster (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hwidrefresh (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hwriter (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hw-tooltip (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hw-transport-node-hid (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hw-olab (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hw-affiliate-toast (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hw-currency (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hw-marketing (npm)
1 compromised version
- Sep 13, 2026
Malicious code in husky_mouse_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hw-clientid (npm)
1 compromised version
Page 542 of 7,329