Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,212 total · sorted newest first- Aug 14, 2025
Malicious code in humanapi-mongoose-list (npm)
- Aug 14, 2025
Malicious code in humanapi-mongoose-encrypt (npm)
- Aug 14, 2025
Malicious code in humanapi-models (npm)
- Aug 14, 2025
Malicious code in humanapi-logger (npm)
- Aug 14, 2025
Malicious code in humanapi-grunt-tasks (npm)
- Aug 14, 2025
Malicious code in humanapi-belt (npm)
- Aug 14, 2025
Malicious code in hulp (npm)
- Aug 14, 2025
Malicious code in hulasync (npm)
- Aug 14, 2025
Malicious code in hukax (npm)
- Aug 14, 2025
Malicious code in huiguan (npm)
- Aug 14, 2025
Malicious code in hugomatic (npm)
- Aug 14, 2025
Malicious code in hugo-thermosphere-nebula-spectroscopy (npm)
- Aug 14, 2025
Malicious code in hugo-neptune-config-mineralogy (npm)
- Aug 14, 2025
Malicious code in hugo-fornax-neptune-playwright (npm)
- Aug 14, 2025
Malicious code in hugo-draco-mini-css-extract-plugin-paleoanthropology (npm)
- Aug 14, 2025
Malicious code in hugo-changelog-achernar-event (npm)
- Aug 14, 2025
Malicious code in hugehard (npm)
- Aug 14, 2025
Malicious code in hufnagel (npm)
- Aug 14, 2025
Malicious code in huflungdu (npm)
- Aug 14, 2025
Malicious code in huffpost (npm)
- Aug 14, 2025
Malicious code in huf_secure_access_api (npm)
- Aug 14, 2025
Malicious code in hudctl (npm)
- Aug 14, 2025
Malicious code in hubspawn (npm)
- Aug 14, 2025
Malicious code in hubot-frostedio-env (npm)
- Aug 14, 2025
Malicious code in hubot-factoids-3ch01c (npm)
- Aug 14, 2025
Malicious code in httpunch (npm)
- Aug 14, 2025
Malicious code in httprules (npm)
- Aug 14, 2025
Malicious code in httplistd (npm)
- Aug 14, 2025
Malicious code in httpguide (npm)
- Aug 14, 2025
Malicious code in httpeace-node-plugin-upload (npm)
- Aug 14, 2025
Malicious code in httpeace-node-core (npm)
- Aug 14, 2025
Malicious code in http-promises-async (npm)
- Aug 14, 2025
Malicious code in http-helmet (npm)
- Aug 14, 2025
Malicious code in http-geobase (npm)
- Aug 14, 2025
Malicious code in http (npm)
- Aug 14, 2025
Malicious code in httiyn7n4avhlugd6xvldzgbwpjsrfjp (npm)
- Aug 14, 2025
Malicious code in htrapit (npm)
- Aug 14, 2025
Malicious code in htproject (npm)
- Aug 14, 2025
Malicious code in htmlglue (npm)
- Aug 14, 2025
Malicious code in html5-escape (npm)
- Aug 14, 2025
Malicious code in html2coffeekup-bal (npm)
- Aug 14, 2025
Malicious code in html-webpack-plugin-panspermia-local-tachyon (npm)
- Aug 14, 2025
Malicious code in html-webpack-plugin-odin-jest-transform (npm)
- Aug 14, 2025
Malicious code in html-patcher (npm)
- Aug 14, 2025
Malicious code in hstester (npm)
- Aug 14, 2025
Malicious code in hsrmap (npm)
- Aug 14, 2025
Malicious code in hsreport (npm)
- Aug 14, 2025
Malicious code in hsf-server (npm)
- Aug 14, 2025
Malicious code in hsf-clients (npm)
- Aug 14, 2025
Malicious code in hscday (npm)
Page 5997 of 7,325