Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,438 total · sorted newest first- Sep 13, 2026
Malicious code in hercules-command-spawn-hapi (npm)
1 compromised version
- Sep 13, 2026
Malicious code in here-watch-tu-jhoothi-main-makkar-at-online-streamings-at-homedsews (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-ganymede-geckodriver-spawn (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-config-juno-void (npm)
1 compromised version
- Sep 13, 2026
Malicious code in here-hd-watch-creed-3-full-movies-hd-online-at-home-free-4k (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-deimos-superagent-webdriverio (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-changelog-tectonic-restart (npm)
1 compromised version
- Sep 13, 2026
Malicious code in here-watch-scream-6-2023-online-on-fullmovies-free-at-home (npm)
1 compromised version
- GHSA-hxcm-c6xh-2wwfMalwarenpmhere-watch-john-wick-chapter-4-full-movies-2023-online-free-streaming-4kSep 13, 2026
Malicious code in here-watch-john-wick-chapter-4-full-movies-2023-online-free-streaming-4k (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hereis-mala-ta (npm)
1 compromised version
- Sep 13, 2026
Malicious code in here-now-to-watch-scream-6-full-horror-movies-online-at-home (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hereis-mani-ta (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hereis-man-ta (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-docusaurus-css-minimizer-webpack-plugin-upgrade (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-husky-ariel-version (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-husky-blaze-equinox (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-meteor-sync-semantic-ui (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-css-loader-restart-eslint-plugin (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-fermion-hyperion-version (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hereis-mala-unta (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hereis-mania-ta (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-forever-commitlint-publish (npm)
1 compromised version
- GHSA-9qr5-f75g-464rMalwarenpmhere-now-to-watch-john-wick-chapter-4-full-keanu-reeves-movies-online-at-homeSep 13, 2026
Malicious code in here-now-to-watch-john-wick-chapter-4-full-keanu-reeves-movies-online-at-home (npm)
1 compromised version
- Sep 13, 2026
Malicious code in here-watch-creed-iii-2023-online-on-fullmovies-free-at-home (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-nextjs-zephyr-install (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hereis-ma-ta (npm)
1 compromised version
- Sep 13, 2026
Malicious code in herdit (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-convict-indus-flare (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-readable-xenon-karma (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-css-minimizer-webpack-plugin-cz-conventional-changelog-dorado (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-less-elektra-hugo (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-fomalhaut-chai-geckodriver (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-event-octans-avior (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-server-achernar-hugo (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-impulse-bootes-hercules (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-commitlint-config-angular-neptune-blaze (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-winston-janus-miranda (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-local-ceres-backend (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-shelljs-xerxes-janus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hereis-maa-ta (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hendra-wajit92-ruro (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hendra-tumis21-ruro (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hendra-ubi95-sluey (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hendra-tumis49-sukiwir (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hendra-wajit88-breki (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hendra-tumis66-ruro (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hendra-tumis18-sluey (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hendra-wajit19-riris (npm)
1 compromised version
- Sep 13, 2026
Malicious code in henriquedias (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hercules-build-metalsmith-graviton (npm)
1 compromised version
Page 581 of 7,329