Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,423 total · sorted newest first- Sep 13, 2026
Malicious code in historic_unicorn_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hissing_frog_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in historic_catshark_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hissing_dove_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hissing_cattle_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in historic_constrictor_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in historic-bronze-lemur (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hissing_koala_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in historical_cat_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in historical_cougar_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in historical-red-lamprey (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hissing_canidae_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in histonat (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hissing_manatee_silver-84 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hissing_vulture_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hissing_barnacle_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hissing_cockroach-apptea (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hissing_lemming_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in historic_harrier_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in historic_leopard_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in historical-coffee-quelea (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hissing_swallow_dumbs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hissing_hamster_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in historic-purple-bat (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hissing_rat-appteadev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in historical_basilisk_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hissing_gamefowl_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hill-gorge-huh825-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hipsterbg (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hissing-moccasin-octopus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hiro-experience-map (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hill-tornado-pds437-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hissing_alligator_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hilarious_snail_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hill-ecosystem-kdd949-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hissing_antlion_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hissing-lavender-anglerfish (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hill-thistle-rdk333-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hilarious_squirrel_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hissing-ivory-owl (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hill-bound-write (npm)
1 compromised version
- Sep 13, 2026
Malicious code in himoysimi (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hill-undertow-dhf073-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hilton-ui (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hill-quasar-ubz623-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hiot-api (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hippocms (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hilarious_rook_moccasin-9 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hilton_cms (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hipstest (npm)
1 compromised version
Page 573 of 7,329