Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,418 total · sorted newest first- Sep 13, 2026
Malicious code in html-webpack-plugin-hologram-stream-install (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-csrf-link-changelog (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-epimetheus-async-vega (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-4 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-cache-spawn-jovian (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-patcher (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-babel-express-inquirer (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-dagda-axios-jest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-atlas-global-lacerta (npm)
1 compromised version
- Sep 13, 2026
Malicious code in html-webpack-plugin-hyperion-vulcan-neptune (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hqmlfg-devapptea (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hsrmap (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hs-sha3 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hsbc-modal (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hstester (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hscday (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hsf-clients (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hqsql (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hq-watch-john-wick-chapter-4-full-movies-online-free-at-homee (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hsf-server (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hsreport (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hpygdtsiukcxolvw (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hqlkgubcovjiskta (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hraxisys-notthedevs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hsba (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hs-api-next-gen (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hqj0rx (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hrxtable (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hrpqvq123111 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hs_codes (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hrodei (npm)
1 compromised version
- Sep 13, 2026
Malicious code in how-to-get-followers-on-instagram-without-following (npm)
1 compromised version
- Sep 13, 2026
Malicious code in how-to-generate-robux-codes-2023-dfklzd (npm)
1 compromised version
- Sep 13, 2026
Malicious code in howto-gallery-betas (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hpackeyboard-core (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hoverfly_beige-39-tisubasah (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hpmm (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hottg47gggg (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hoverfly_orange-43-tisubasah (npm)
1 compromised version
- Sep 13, 2026
Malicious code in how-to-get-free-coin-master-spins-2023-working-and-updated-jjeef (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hp-svc-facs-store (npm)
1 compromised version
- Sep 13, 2026
Malicious code in how-iget-free-fortnite-vbucks-daily-jfkze (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hoxljg-devapptea (npm)
1 compromised version
- Sep 13, 2026
Malicious code in how-to-get-unlimited-coin-master-spins-daily-in-2023-efkedz (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hp1dma (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hpi-porsche-app (npm)
1 compromised version
- Sep 13, 2026
Malicious code in how-to-watch-scream-6-online-free-fullmovies (npm)
1 compromised version
- Sep 13, 2026
Malicious code in howwrong (npm)
1 compromised version
- Sep 13, 2026
Malicious code in how_to_watch_miami_open_2023_tennis_free_e (npm)
1 compromised version
- Sep 13, 2026
Malicious code in howell-soluble-pot (npm)
1 compromised version
Page 554 of 7,329