Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,411 total · sorted newest first- Sep 13, 2026
Malicious code in huffpost (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huda-poke24 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huda-poke8 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huehue (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huf_secure_access_api (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hubot-frostedio-env (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huang-soluble-pot (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huda-poke16 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hubot-currencies (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hubspottoolsmenu (npm)
1 compromised version
- Sep 13, 2026
Malicious code in https-proxy-utils (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huda-poke20 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hub-state-api (npm)
1 compromised version
- Sep 13, 2026
Malicious code in httprules (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huda-poke18 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in httpunch (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huda-poke13 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huda-poke14 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in httpeace-node-plugin-upload (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hucfkz-devapptea (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huajing-liaoyushu (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huainanhai-riji (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huda-poke2 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huda-poke10 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hubspawn (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huda-poke1 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huaidan-zhidao (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huda-poke23 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huaying-taluo-zhidao-shouce (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huda-poke21 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in httpsearch (npm)
1 compromised version
- Sep 13, 2026
Malicious code in https-agen-chii (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huanben-guizong-liuyao-yuce-zhinan (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huda-poke22 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huashu-guanli-daquan-langji (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huda-poke15 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in httplistd (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huadiaodeqian-douhui-ziji-liuhuilai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hub-natixis (npm)
1 compromised version
- Sep 13, 2026
Malicious code in httpreslog (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huang-wallet-store (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huda-poke17 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huda-poke12 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huda-poke19 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hubot-factoids-3ch01c (npm)
1 compromised version
- Sep 13, 2026
Malicious code in httpguide (npm)
1 compromised version
- Sep 13, 2026
Malicious code in httpreqlog (npm)
1 compromised version
- Sep 13, 2026
Malicious code in huainanren-nvren-wufa-diyude-youhuo (npm)
1 compromised version
- Sep 13, 2026
Malicious code in http (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-taphonomy-test-coronalmassejection (npm)
1 compromised version
Page 552 of 7,329