Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,418 total · sorted newest first- Sep 13, 2026
Malicious code in hotel-re0-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in housecallpro (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotel-honeydew-qjlt (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotel-elderberry-tangerine-vpmde (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotel-k7n-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotelsys (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotel-zucchini-sierra-ehqmk (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotel-elderberry-vsgz (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotel-nl6-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotel-whiskey-alpha-qwqlo (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotel-h1p-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotel-etm-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotel-v6f-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in HotJS (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotels-widget (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_cod_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotel-ab7-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot-copper-skink (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotel-echo-date-woscz (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_marlin_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_llama_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_wasp_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotel-apple-banana-bdaxu (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_rat_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_flyingfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_piranha_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_locust_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_bobcat_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_mole_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_tarantula_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotel-byc-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_halibut_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_hamster_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_owl_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotbeer (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot-scarlet-elk (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotel-banana-fmhr (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_junglefowl_apricot-13 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot-thread-cold-fast-epsilon (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotel-cld-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_basilisk_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotel-4w1-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_opossum_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_urial_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_gayal_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotdoc-ember-bookings (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_snake_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotel-2hp-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot-decrypt-private-orchestrate-tau (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_planarian_dumbs (npm)
1 compromised version
Page 556 of 7,329