Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,204 total · sorted newest first- Aug 14, 2025
Malicious code in hill-ecosystem-kdd949-project (npm)
- Aug 14, 2025
Malicious code in hill-dragon-vem951-project (npm)
- Aug 14, 2025
Malicious code in hill-boulder-izu499-project (npm)
- Aug 14, 2025
Malicious code in hilaris (npm)
- Aug 14, 2025
Malicious code in hijink (npm)
- Aug 14, 2025
Malicious code in hihihiha (npm)
- Aug 14, 2025
Malicious code in higirl (npm)
- Aug 14, 2025
Malicious code in highliht.js (npm)
- Aug 14, 2025
Malicious code in highkick (npm)
- Aug 14, 2025
Malicious code in highjump (npm)
- Aug 14, 2025
Malicious code in higgs-bellatrix-resolvers-typeorm (npm)
- Aug 14, 2025
Malicious code in hifijs (npm)
- Aug 14, 2025
Malicious code in hidbase (npm)
- Aug 14, 2025
Malicious code in hhotel (npm)
- Aug 14, 2025
Malicious code in hhjslib (npm)
- Aug 14, 2025
Malicious code in hgfiuythdjfhgff (npm)
- Aug 14, 2025
Malicious code in hfwehew (npm)
- Aug 14, 2025
Malicious code in hfjh5sm3jihqkc1toapmcrfkma08ki46 (npm)
- Aug 14, 2025
Malicious code in hfexcjvbsimukypz (npm)
- Aug 14, 2025
Malicious code in heyhamont (npm)
- Aug 14, 2025
Malicious code in hextest (npm)
- Aug 14, 2025
Malicious code in hexpacker (npm)
- Aug 14, 2025
Malicious code in hexo-iota-betelgeuse-development (npm)
- Aug 14, 2025
Malicious code in hexo-fermion-holography-quasarjet (npm)
- Aug 14, 2025
Malicious code in hexo-cluster-steganography-jsonp (npm)
- Aug 14, 2025
Malicious code in hexkits (npm)
- Aug 14, 2025
Malicious code in hexarobot (npm)
- Aug 14, 2025
Malicious code in hexapong (npm)
- Aug 14, 2025
Malicious code in hexagone (npm)
- Aug 14, 2025
Malicious code in hexabump (npm)
- Aug 14, 2025
Malicious code in hewotuan (npm)
- Aug 14, 2025
Malicious code in hevajra (npm)
- Aug 14, 2025
Malicious code in heumon (npm)
- Aug 14, 2025
Malicious code in hesseso (npm)
- Aug 14, 2025
Malicious code in herotale (npm)
- Aug 14, 2025
Malicious code in herokuup (npm)
- Aug 14, 2025
Malicious code in herokupy (npm)
- Aug 14, 2025
Malicious code in heroku-sudo (npm)
- Aug 14, 2025
Malicious code in hermes-paleontology-taurus-wavefunction (npm)
- Aug 14, 2025
Malicious code in hermes-orbit-eslint-config-comet (npm)
- Aug 14, 2025
Malicious code in hermes-fornax-typeorm-shelljs (npm)
- Aug 14, 2025
Malicious code in hermes-epimetheus-meteor-commitlint (npm)
- Aug 14, 2025
Malicious code in hermes-celeste-react-bootstrap-nodejs (npm)
- Aug 14, 2025
Malicious code in herkcoin (npm)
- Aug 14, 2025
Malicious code in hereaccount-nodejs (npm)
- Aug 14, 2025
Malicious code in herdit (npm)
- Aug 14, 2025
Malicious code in hercules-changelog-tectonic-restart (npm)
- Aug 14, 2025
Malicious code in hercules-centaurus-oberon-sync (npm)
- Aug 14, 2025
Malicious code in hercules-build-metalsmith-graviton (npm)
- Aug 14, 2025
Malicious code in heqetlabs (npm)
Page 6004 of 7,325