Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,487 total · sorted newest first- Sep 13, 2026
Malicious code in hellodependency2 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-antares-meissa-koa (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hello-world-lupin (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-blaze-eridanus-galaxy (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hello-world-from-lupin-99 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hello_ltb (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hello-world-target (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hellodependency1 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hellodependency001 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-cache-galaxy-alphard (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hellodependency3 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hello-user-test-npm-com-test (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-bellatrix-kastra-pulsar (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hellodependency5 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-convict-mongoose-cz-conventional-changelog (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hello-demo-lib (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helloworldmyworld (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hellonew (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-blitz-izar-update (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helloModule (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helmet-atlas-dione-juno (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hellstorm (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hello-shai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hellomav (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hello-world-from-lupin-95 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helios-nightwatch-tethys-eridanus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helios-coronalmassejection-carina-crust (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helios-configstore-orbit-meteor (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hello-arc-windows (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helios-europa-soap-europa (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helixbox-connect (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hello-arc (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hello-cloud (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helios-grus-morgan-tailwindcss (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helios-google-venus-library (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helios-webdriver-mocha-superposition-phylogenetics (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heliotrope (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helios-fusion-rollup-command (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helios-event-carpo-apex (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helios-procyon-acamar-andromeda (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helios-html-webpack-plugin-colors-achernar (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helios-epigenetics-asteroid-eclipse (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heliosphere-wormhole-mqqr (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helios-magellan-server-helmet (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helios-odin-start-stream (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helios-uglify-js-nextjs-kaus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helios-css-loader-kastra-transform (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hellcity (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helios-ultra-rollup-plugin-gridsome (npm)
1 compromised version
- Sep 13, 2026
Malicious code in helios-zenobia-geckodriver-rigel (npm)
1 compromised version
Page 598 of 7,330