Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,408 total in npm · sorted newest first- Nov 24, 2025
Malicious code in mcp-use (npm)
2 compromised versions
- Nov 24, 2025
Malicious code in create-mcp-use-app (npm)
2 compromised versions
- Nov 24, 2025
Malicious code in capacitor-voice-recorder-wav (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @zapier/stubtree (npm)
3 compromised versions
- Nov 24, 2025
Malicious code in @zapier/spectral-api-ruleset (npm)
3 compromised versions
- Nov 24, 2025
Malicious code in @zapier/mcp-integration (npm)
3 compromised versions
- Nov 24, 2025
Malicious code in @zapier/ai-actions-react (npm)
3 compromised versions
- Nov 24, 2025
Malicious code in @seung-ju/react-native-action-sheet (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @postman/wdio-junit-reporter (npm)
3 compromised versions
- Nov 24, 2025
Malicious code in @postman/wdio-allure-reporter (npm)
3 compromised versions
- Nov 24, 2025
Malicious code in @postman/secret-scanner-wasm (npm)
3 compromised versions
- Nov 24, 2025
Malicious code in @postman/pretty-ms (npm)
3 compromised versions
- Nov 24, 2025
Malicious code in @postman/postman-mcp-server (npm)
3 compromised versions
- Nov 24, 2025
Malicious code in @postman/postman-mcp-cli (npm)
3 compromised versions
- Nov 24, 2025
Malicious code in @postman/postman-collection-fork (npm)
3 compromised versions
- Nov 24, 2025
Malicious code in @postman/pm-bin-windows-x64 (npm)
3 compromised versions
- Nov 24, 2025
Malicious code in @postman/pm-bin-macos-x64 (npm)
3 compromised versions
- Nov 24, 2025
Malicious code in @postman/pm-bin-macos-arm64 (npm)
3 compromised versions
- Nov 24, 2025
Malicious code in @postman/pm-bin-linux-x64 (npm)
3 compromised versions
- Nov 24, 2025
Malicious code in @postman/mcp-ui-client (npm)
3 compromised versions
- Nov 24, 2025
Malicious code in @postman/final-node-keytar (npm)
3 compromised versions
- Nov 24, 2025
Malicious code in @posthog/wizard (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/web-dev-server (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/variance-plugin (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/url-normalizer-plugin (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/twitter-followers-plugin (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/twilio-plugin (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/taxonomy-plugin (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/snowflake-export-plugin (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/sendgrid-plugin (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/rrweb-player (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/react-rrweb-player (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/plugin-unduplicates (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/pagerduty-plugin (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/nextjs-config (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/nextjs (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/maxmind-plugin (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/kinesis-plugin (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/ingestion-alert-plugin (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/hedgehog-mode (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/gitub-star-sync-plugin (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/github-release-tracking-plugin (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/geoip-plugin (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/first-time-event-tracker (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/event-sequence-timer-plugin (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/databricks-plugin (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/customerio-plugin (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/currency-normalization-plugin (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/automatic-cohorts-plugin (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @mparpaillon/page (npm)
1 compromised version
Page 254 of 4,809