Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,411 total · sorted newest first- Sep 13, 2026
Malicious code in human_bobolink_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-sedna-element-ui-css-minimizer-webpack-plugin (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-stop-callback-bootstrap (npm)
1 compromised version
- Sep 13, 2026
Malicious code in human_jackal_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hukax (npm)
1 compromised version
- Sep 13, 2026
Malicious code in human_haddock_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hulp (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-spinner-optimize-css-assets-webpack-plugin-luna (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-plutology-comet-cluster (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-tool-ignite-materialize (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-draco-mini-css-extract-plugin-paleoanthropology (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huge_monkey-appteadev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-capella-janus-nucleosynthesis (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huge_parrotfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-chariklo-oauth-carina (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-changelog-achernar-event (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huge-turquoise-gull (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-mini-css-extract-plugin-ophiuchus-convict (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-mira-node-sass-nashira (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-eslint-config-rimraf-nodejs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huge_monkey-strongdev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-io-commitizen-shelljs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugehard (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-dependencies-quantum-janus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-neptune-config-mineralogy (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huggingface-vscode (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huge_macaw_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-miranda-prettier-stylelint-xenon (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huge_cuckoo_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-loglevel-fomalhaut-optimize-css-assets-webpack-plugin (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huge_herring_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-build-configstore-rollup-plugin (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huge_mite_requirement (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huge_sloth_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-chromedriver-koa-upgrade (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-mira-xenon-adonis (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-delphinus-mini-css-extract-plugin-hermes (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-elektra-quantum-wasat (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huge_swift_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huge_fowl_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huge_hamster_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-cloudflare-docs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huge_reptile_dumbs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-cassini-gulp-flare (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-fornax-neptune-playwright (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huge_takin_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-mini-css-extract-plugin-phoebe-chakra-ui (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huge_scallop_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-chalk-rigel-phoebe (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hugo-cosmiconfig-hugo-canopus (npm)
1 compromised version
Page 550 of 7,329