Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,488 total · sorted newest first- Sep 13, 2026
Malicious code in haven-bes9v-66v54-fern-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hassanescargot (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hash-table-enum-debug-unix (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hashimfahad (npm)
1 compromised version
- Sep 13, 2026
Malicious code in haruni-poke126 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in haven-23lrq-dpwho-pearl-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hasaweb (npm)
1 compromised version
- Sep 13, 2026
Malicious code in haven-1v0nt-fi8so-xenon-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hathormobile (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hatebu (npm)
1 compromised version
- Sep 13, 2026
Malicious code in haven-5ynlj-z2reg-raven-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hash-char-new-alert-sandbox (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hash-cloud-short-void-cluster (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hashdump (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hash-query-string-assert-catch (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hash-warn-async-private-shell (npm)
1 compromised version
- Sep 13, 2026
Malicious code in haven-a2bca-taw6k-nymph-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hathor-wallet (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hasibaftab (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harvesting-utils (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hassanlateef (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hasulam (npm)
1 compromised version
- Sep 13, 2026
Malicious code in havegive (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hassanabdul (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hash-sha256 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in haven-2i52m-qglgk-star-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in haruni-poke123 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in haruni-poke125 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hathor-healthcheck-lib (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hash-test-interface-emulate-file (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hassanraza (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hash-uglify-cluster-info-orchestrate (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hassanqadir (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hathor-wallet-headless (npm)
1 compromised version
- Sep 13, 2026
Malicious code in haven-9yae4-l6wbd-ember-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hassanameen (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hatcraft (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hast-util-to-babel-ast (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harvesting-twitter (npm)
1 compromised version
- Sep 13, 2026
Malicious code in haruni-poke124 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hash-authorize-sanitize-signal-cloud (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hasard-core (npm)
1 compromised version
- Sep 13, 2026
Malicious code in haswons (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hash-bash-easy-xi-table (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hash-spy-mock-web-sed (npm)
1 compromised version
- Sep 13, 2026
Malicious code in haucict (npm)
1 compromised version
- Sep 13, 2026
Malicious code in havas-worldwide (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harvesting-mongodb (npm)
1 compromised version
- Sep 13, 2026
Malicious code in haven-387xx-89mga-coral-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in haruni-poke119 (npm)
1 compromised version
Page 605 of 7,330