Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,487 total · sorted newest first- Sep 13, 2026
Malicious code in heka-mini-css-extract-plugin-xenos-prompts (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heka-antares-vulcan-commitizen (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heka-markdownlint-rollup-node-config (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heka-centaurus-nodemon-hydrogeology (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heix-erlinglingwu-part4 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heka-apex-firebase-hyperion (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heiyarus-notthedevs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heix-erlinglingsan-part6 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heix-erlinglingsan-part4 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heka-axios-norma-npm (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heka-chromedriver-relay-dorado (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heka-mdx-kaus-indus (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heka-buffer-holography-subduction (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heka-perseus-jasmine-yonder (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heka-buffer-install-transform (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heka-europa-europa-gulp (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heix-erlinglingsan-part5 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heka-nebula-rollup-plugin-inquirer (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heix-erlinglingwu-part1 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heka-hercules-react-bootstrap-darkenergy (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heka-pegasus-pino-pretty-mira (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heka-exec-terser-webpack-plugin-start (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heka-postgres-update-publish (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heka-native-frontend-lint-staged (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heka-express-axios-eslint-plugin (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heix-erlinglingwu-part3 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heix-heike-rumen (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heka-jsonp-triton-fetch (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heka-lint-pulsar-install (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heix-erlinglingliu-part3 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heix-erlinglinger-part2 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hedwig-tsconfig (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_toucan_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hedgehog-aroma-swh506-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heft-storybook-react-tutorial (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heix-erlinglingqi-part1 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heft-web-rig-library-tutorial (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_jaguar_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hedgehog-vortex-hiz322-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heft-example-plugin-02 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heike-shegong-dangandai (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heix-erlinglingsan-part3 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heike-jiaoben-quanben (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heft-example-lifecycle-plugin (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_yak_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_worm_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heike-shegong-dangandai2 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heike-cidian-zhongwenban (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_louse_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heft-example-plugin-01 (npm)
1 compromised version
Page 600 of 7,330