diff --git a/pkgs/by-name/wh/whisper/package.nix b/pkgs/by-name/wh/whisper/package.nix
deleted file mode 100644
index 86dceb755633..000000000000
--- a/pkgs/by-name/wh/whisper/package.nix
+++ /dev/null
@@ -1,68 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchpatch,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "whisper";
-  version = "2.0.1";
-
-  src = fetchFromGitHub {
-    owner = "refresh-bio";
-    repo = "whisper";
-    rev = "v${version}";
-    sha256 = "0wpx1w1mar2d6zq2v14vy6nn896ds1n3zshxhhrrj5d528504iyw";
-  };
-
-  patches = [
-    # gcc-13 compatibility fixes:
-    #   https://github.com/refresh-bio/Whisper/pull/17
-    (fetchpatch {
-      name = "gcc-13.patch";
-      url = "https://github.com/refresh-bio/Whisper/commit/d67e110dd6899782e4687188f6b432494315b0b4.patch";
-      hash = "sha256-Z8GrkUMIKO/ccEdwulQh+WUox3CEckr6NgoBSzYvfuw=";
-    })
-  ];
-
-  preConfigure = ''
-    cd src
-
-    # disable default static linking
-    sed -i 's/ -static / /' makefile
-  '';
-
-  enableParallelBuilding = true;
-
-  # The package comes with prebuilt static
-  # libraries of bzip2, zlib, libdeflate and asmlib.
-  # They are not built with -fPIE and thus linking fails.
-  # As asmlib is not packages in nixpkgs let's disable PIE.
-  env.NIX_LDFLAGS = "-no-pie";
-
-  installPhase = ''
-    runHook preInstall
-    install -Dt $out/bin whisper whisper-index
-    runHook postInstall
-  '';
-
-  meta = {
-    broken = stdenv.hostPlatform.isDarwin;
-    description = "Short read sequence mapper";
-    license = lib.licenses.gpl3;
-    # vendored libraries acof, aelf, deflate, bzip2, zlib
-    # https://github.com/refresh-bio/Whisper/issues/18
-    knownVulnerabilities = [
-      # src/libs/libz.a from 2017
-      "CVE-2018-25032"
-      "CVE-2022-37434"
-      # src/libs/libbzip2.lib
-      "CVE-2019-12900"
-    ];
-    homepage = "https://github.com/refresh-bio/whisper";
-    maintainers = with lib.maintainers; [ jbedo ];
-    platforms = lib.platforms.x86_64;
-    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 70d75fb3384a..d04309901da9 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -2163,6 +2163,7 @@ mapAliases {
   welkin = throw "welkin was removed as it is unmaintained upstream"; # Added 2026-01-01
   whalebird = throw "'whalebird' has been removed because it was using an EOL electron version"; # Added 2026-03-20
   whatsapp-for-linux = throw "'whatsapp-for-linux' has been removed because it was unmaintained and archived upstream. Consider using 'karere' instead"; # Converted to throw 2025-10-27
+  whisper = throw "'whisper' was removed as it is unmaintained upstream and vendored insecure outdated libraries"; # Added 2026-05-01
   wifi-password = throw "'wifi-password' has been removed as it was unmaintained upstream"; # Added 2025-08-29
   win-pvdrivers = throw "'win-pvdrivers' has been removed as it was subject to the Xen build machine compromise (XSN-01) and has open security vulnerabilities (XSA-468)"; # Added 2025-08-29
   win-virtio = throw "'win-virtio' has been renamed to/replaced by 'virtio-win'"; # Converted to throw 2025-10-27