Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,488 total · sorted newest first- Sep 13, 2026
Malicious code in heartstone-nft-collcetion131 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in healthy_camel_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head_wildebeest_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head_mongoose_z3n (npm)
1 compromised version
- GHSA-x7vp-3wj9-hh8rMalwarenpmhdc-cuevana3-ant-man-and-the-wasp-quantumania-ver-cuevana-en-esphanol-latinoSep 13, 2026
Malicious code in hdc-cuevana3-ant-man-and-the-wasp-quantumania-ver-cuevana-en-esphanol-latino (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hdfkit (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head_mole_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hbtrack (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head_raven_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head_bear_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head_jaguar_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head_bobcat_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hdworld (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hazel-whiskey-l2ig (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hd-tu-jhoothi-main-makkar-on-full-movies-online-streaming (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hdkye (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head_urial_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head_eagle_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hcdemos (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head-sapphire-skunk (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head_python_z3n (npm)
1 compromised version
- GHSA-h2gh-9h3x-25hjMalwarenpmhd-everything-everywhere-all-at-once-2022-online-on-fullmovies-free-at-homeSep 13, 2026
Malicious code in hd-everything-everywhere-all-at-once-2022-online-on-fullmovies-free-at-home (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head_roadrunner_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head_worm_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head_pelican_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hds-input (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head-white-bovid (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hazel-redshift-60dx (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hazel-windmill-tyeg (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head_koi_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head_canidae_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head_tiglon_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head_toad_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hdebug (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hcompare (npm)
1 compromised version
- Sep 13, 2026
Malicious code in healge (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hcrckiosk (npm)
1 compromised version
- Sep 13, 2026
Malicious code in heading (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hcs-image-viewer (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hbqxpro (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head_zebra_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in headache (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hazel-lunar-nemb (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hbmediaelement (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head_flyingfish_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head-scarlet-pigeon (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hazel-vinegar-mx3y (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head_firefly_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hazel-pier-9a36 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in head_armadillo_z3n (npm)
1 compromised version
Page 603 of 7,330