Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,438 total · sorted newest first- Sep 13, 2026
Malicious code in hicks-validator-catalyst (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hidden_peafowl_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hidden_limpet_indigo-4 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hidden_mastodon_salmon-43 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hidden-purple-booby (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hibt-dev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hidden_ptarmigan_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hfwehew (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heroisme (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-norma-cygnus-child-process (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-sirius-karma-juno (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hermes-zenobia-wasat-chai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexabump (npm)
1 compromised version
- Sep 13, 2026
Malicious code in herokupy (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-sails-element-ui-jsonp (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-hugo-apollo-kronos (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-steganography-cli-standard (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-lacerta-colors-deneb (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hermes-xml-auth0-sirius (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-spectron-webdriver-odin-library (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-commitlint-config-angular-nuxtjs-neptune (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-mocha-carpo-element-ui (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-fetch-jwt-typeorm (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexoffsectest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-cluster-steganography-jsonp (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-child-process-chromedriver-jupiter (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hex-stablecoin (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-iota-betelgeuse-development (npm)
1 compromised version
- Sep 13, 2026
Malicious code in herotale (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexapong (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-phenomic-odin-element-ui (npm)
1 compromised version
- Sep 13, 2026
Malicious code in herokuup (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexkits (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hermione-login-plugin (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-restart-farout-sync (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-sagitta-commitlint-halley (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexmex-tesstt (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-publish-hexo-xo (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-ora-quark-loglevel (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-fermion-holography-quasarjet (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-docusaurus-hexo-rimraf (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hevajra (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-procyon-neptune-spectron-webdriver (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-quantum-vuetify-update (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-iota-release-it-epimetheus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hesseso (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-duplex-xenos-bootstrap (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hewotuan (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexo-csrf-slides-install (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hexagone (npm)
1 compromised version
Page 577 of 7,329