Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,418 total · sorted newest first- Sep 13, 2026
Malicious code in hot_rodent_turquoise-43 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotel-5wp-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot-violet-jaguar (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_wildfowl_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_swordfish_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotel-03v-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot-float-moon-unix-fork (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_cobra_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_manatee_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotel-czu-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_jaguar_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_unicorn_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_cephalopod_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_elephant_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot-buried-mental (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_parrot_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotel-c43-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot-awk-authorize-float-interface (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_sole_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hotel-echo-papaya-rfurx (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot_mollusk_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in horseradish-watermelon-f06z (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot-air-thread-minify-assert (npm)
1 compromised version
- Sep 13, 2026
Malicious code in horseradish-yam-7jib (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hot-amber-fowl (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hostile_wildcat_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hostile_hoverfly_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hostile_thrush_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hostile_grouse_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hostile_kingfisher-gooddev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hostile_bison-strongdev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hostile_koala-silentdev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hostile_bat_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hostile_skink_violet-16 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hostile_nightingale_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hostile-ivory-porpoise (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hostile-rose-crane (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hostile_seahorse_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hosted-hubot (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hostile_finch_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hostile_butterfly_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hostile_owl_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hostile_mole_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hostile_ocelot-appteadev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hostile_gayal_dumbs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hosted-buttons (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hostile_crayfish_dumbs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hostname_chacker (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hostile-lime-xerinae (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hostile-blue-bedbug (npm)
1 compromised version
Page 557 of 7,329