Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,488 total · sorted newest first- Sep 13, 2026
Malicious code in heft-example-plugin-01 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heix-erlinglinger-part1 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heiban (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heike-zhuliu-gongji-daquan (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hedgehog-waterfall-vsl162-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hebiteiki (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hedgehog-xerus-cpl405-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_nightingale_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heitorlima (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_reptile_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heix-erlinglingliu-part2 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heft-minimal-rig-test (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hedgehog-registry (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hedgehog-orchid-phg379-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hedgehog-quasar-ppf530-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heike-yuying-shouce (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_peafowl_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_iguana_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hedgehog-willow-klf228-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heike-shentou-biji (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_sole-appteadev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heix-erlinglingliu-part1 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_wildcat_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heix-erlinglingliu-part4 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heike-shuyu-tuwen-cidian (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hedgehog-whale-pdg410-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heft-parameter-plugin (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hedgehog-yucca-wxs277-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_partridge_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heix-erlinglingqi-part4 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heix-erlinglingqi-part2 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heike-riji-jingzhuangban (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_tahr_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heidong-xiyin (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_dove_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_bobolink_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_donkey_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_hyena_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy-maroon-gazelle (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_armadillo_aqua-64 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_fox_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_egret_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_capybara_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_canidae_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_basilisk_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_anaconda_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_alpaca_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_hummingbird_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_gibbon_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heavy_bobolink_dumbs (npm)
1 compromised version
Page 601 of 7,330