Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,487 total · sorted newest first- Sep 13, 2026
Malicious code in helpless_mammal_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helpless-ivory-cardinal (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helpful_perch_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helpful_sloth_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helpful_bird_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helpless_mole_aquamarine-54 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helowrold (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-terser-isostasy-nova (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helpful-jade-bee (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-zenobia-jest-slidev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helpful-rose-xerinae (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-uglify-js-slides-link (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helpful-apricot-goose (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helpful-indigo-goose (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-vuetify-testcafe-foundation (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helpful-yellow-guineafowl (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helpful-salmon-boar (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helpful-plum-falcon (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-spectron-ophiuchus-lint-staged (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-supercluster-release-it-technosignature (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-sagitta-saturnology-element-ui (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-sirius-ini-mocha (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-spectroscopy-nucleosynthesis-jsonp (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-slidev-bellatrix-babel (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-taurus-json-alphard (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-release-it-enceladus-figures (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-rollup-plugin-odin-pino-pretty (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-radiant-babel-dorado (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-rate-limiter-superagent-umbra (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-miranda-halley-colors (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-geochronology-rigel-sails (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-deimos-enceladus-atlas (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-postgres-semantic-ui-frontend (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-neutronstar-xo-xerxes (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-nashira-carina-parcel (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-dactyl-flare-uglify-js (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-fetch-forever-registry (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-eleventy-eclipse-slidev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-pegasus-non-blocking-phoebe (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-cordelia-enceladus-terser (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-mysql-auriga-elektra (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-framework-concurrently-jovian (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-public-odin-commitlint (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-lepton-baryon-gravitationalwave (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-native-quito-capella (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-enif-gridsome-hercules (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-mui-eslint-plugin-webdriver-mocha (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hellodependency4 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hellodependency01 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmelar (npm)
1 compromised version
Page 597 of 7,330