Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,488 total · sorted newest first- Sep 13, 2026
Malicious code in harmony_w1byd_ibuca_whisper (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harsh_cardinal-smiletea (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harsh_gayal_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harmony_n5gop_4pegj_cascade (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harom-notthedevs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harsh_bison_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harp-xru52-rref5-verdant-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harmony_2kg4k_k65to_xenith (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harsh_booby_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harp-8dtdy-0fmvk-glow-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harsh_gopher_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harp-8uplv-sqsxc-harmony-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harsh-lime-flamingo (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harpjs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harsh_boa_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harp-86myn-b5m8t-dusk-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harsh_bat_dumbs (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harsh_armadillo_0xrequest (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harsh_dragon_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harsh_emu-appteadev (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harrington-wallet-store (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harrington-soluble-pot (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harsh_damselfly_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harsh-crimson-cod (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harmony-v4atz-4fx7f-zenith-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harsh_haddock_z3n (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harmonic_9v7xh_78x6j_twilight (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hariyono-poke9 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hariyono-poke36 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hariyono-poke5 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hariyono-poke48 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hariyono-poke54 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harmonic_ivoa4_q26er_tundra (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harman (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harmonic_np1hi_vafs1_atlas (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harmony-1inh6-b1o7d-harp-project (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hariyono-poke39 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hariyono-poke33 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hariyono-poke34 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hariyono-poke62 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hariyono-poke49 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hariyono-poke61 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hariyono-poke40 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hariyono-poke43 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hariyono-poke57 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hariyono-poke38 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in harmonic_v8o5m_ho0xa_dusk (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hariyono-poke56 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hariyono-poke41 (npm)
1 compromised version
- Sep 13, 2026
Malicious code in hariyono-poke51 (npm)
1 compromised version
Page 607 of 7,330