Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,411 total · sorted newest first- Sep 13, 2026
Malicious code in html-webpack-plugin-hercules-aldebaran-electron (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-xenon-gacrux-io (npm)
1 compromised version
- Sep 13, 2026
Malicious code in httiyn7n4avhlugd6xvldzgbwpjsrfjp (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-sedna-css-loader-nebula (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-panspermia-local-tachyon (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html5-escape (npm)
1 compromised version
- Sep 13, 2026
Malicious code in http-promises-async (npm)
1 compromised version
- Sep 13, 2026
Malicious code in htproject (npm)
1 compromised version
- Sep 13, 2026
Malicious code in http-geobase (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-zenobia-terser-sqlite (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-kronos-phoenix-antd (npm)
1 compromised version
- Sep 13, 2026
Malicious code in htrapit (npm)
1 compromised version
- Sep 13, 2026
Malicious code in http-helmet (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-sync-perseus-castor (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-kastra-yakutsk-hyperion (npm)
1 compromised version
- Sep 13, 2026
Malicious code in htmlcontent (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html2coffeekup-bal (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-ganymede-test-dione (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-middleware-plutology-impulse (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-transform-google-transport (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-zenobia-nebula-antares (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-multiverse-proteomics-blackhole (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-postcss-aether-magellan (npm)
1 compromised version
- Sep 13, 2026
Malicious code in http-api-lookup (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-epimetheus-unuk-configstore (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-wasat-fornax-eris (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-janus-nightwatch-epimetheus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hts-open-dex-react-ui (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-promise-meteor-dactyl (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-slides-bunyan-node-config (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-procyon-airbnb-relay (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-odin-jest-transform (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-rigel-heka-gemini (npm)
1 compromised version
- Sep 13, 2026
Malicious code in http-message-signatures-extension (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-version-vulcan-rollup (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-deimos-toml-command (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-vega-atlas-fetch (npm)
1 compromised version
- Sep 13, 2026
Malicious code in htmlglue (npm)
1 compromised version
- Sep 13, 2026
Malicious code in httpeace-node-core (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-yakutsk-sass-loader-impulse (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-wavefunction-local-ora (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-upgrade-remark-enceladus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-astro-blitz-procyon (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-hologram-stream-install (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-csrf-link-changelog (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-epimetheus-async-vega (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-4 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-cache-spawn-jovian (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-patcher (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-babel-express-inquirer (npm)
1 compromised version
Page 553 of 7,329