Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,197 total in npm · sorted newest first- Aug 14, 2025
Malicious code in pulsanote (npm)
- Aug 14, 2025
Malicious code in pull-goth-lsk (npm)
- Aug 14, 2025
Malicious code in pug-i18n-loader (npm)
- Aug 14, 2025
Malicious code in pug-ctp-filter (npm)
- Aug 14, 2025
Malicious code in puffcorn (npm)
- Aug 14, 2025
Malicious code in pucclass (npm)
- Aug 14, 2025
Malicious code in pubtapper (npm)
- Aug 14, 2025
Malicious code in pubperz (npm)
- Aug 14, 2025
Malicious code in publish_anu1 (npm)
- Aug 14, 2025
Malicious code in publish-test-min-module (npm)
- Aug 14, 2025
Malicious code in publish-superagent-websockets-gulp (npm)
- Aug 14, 2025
Malicious code in publish-process-postcss-loader-protractor (npm)
- Aug 14, 2025
Malicious code in publish-link-sedna-html-webpack-plugin (npm)
- Aug 14, 2025
Malicious code in publish-jekyll-remark-uranology (npm)
- Aug 14, 2025
Malicious code in publish-biotechnology-update-cosmicray (npm)
- Aug 14, 2025
Malicious code in publictcp (npm)
- Aug 14, 2025
Malicious code in public-object-validate-user-decrypt (npm)
- Aug 14, 2025
Malicious code in public-mock-wind-xi-interface (npm)
- Aug 14, 2025
Malicious code in public-csv-carpo-cygnus (npm)
- Aug 14, 2025
Malicious code in public-config (npm)
- Aug 14, 2025
Malicious code in public-antares-leda-morgan (npm)
- Aug 14, 2025
Malicious code in pub_anu1 (npm)
- Aug 14, 2025
Malicious code in pu-schedule-connect (npm)
- Aug 14, 2025
Malicious code in pu-commerce-connect (npm)
- Aug 14, 2025
Malicious code in pttrnflow (npm)
- Aug 14, 2025
Malicious code in ptswkrvzhlmnqojy (npm)
- Aug 14, 2025
Malicious code in ptswithgc (npm)
- Aug 14, 2025
Malicious code in ptstobvh (npm)
- Aug 14, 2025
Malicious code in ptsboof (npm)
- Aug 14, 2025
Malicious code in ptocalc (npm)
- Aug 14, 2025
Malicious code in ptjksqbonlhdcviz (npm)
- Aug 14, 2025
Malicious code in pt-serif (npm)
- Aug 14, 2025
Malicious code in pt-mono (npm)
- Aug 14, 2025
Malicious code in psygen (npm)
- Aug 14, 2025
Malicious code in psttest (npm)
- Aug 14, 2025
Malicious code in pslogging (npm)
- Aug 14, 2025
Malicious code in pseuwow (npm)
- Aug 14, 2025
Malicious code in psamanta (npm)
- Aug 14, 2025
Malicious code in psa-generator (npm)
- Aug 14, 2025
Malicious code in prymeui (npm)
- Aug 14, 2025
Malicious code in pruksa (npm)
- Aug 14, 2025
Malicious code in pruebay (npm)
- Aug 14, 2025
Malicious code in pru-forms (npm)
- Aug 14, 2025
Malicious code in pru-colours (npm)
- Aug 14, 2025
Malicious code in prpo-types (npm)
- Aug 14, 2025
Malicious code in proxy-prototype (npm)
- Aug 14, 2025
Malicious code in proxy-compile-private-tau-grep (npm)
- Aug 14, 2025
Malicious code in proxima-eridanus-xml-jsonp (npm)
- Aug 14, 2025
Malicious code in proxima-commitlint-commitizen-aurora (npm)
- Aug 14, 2025
Malicious code in proxima-callisto-prettier-stylelint-titan (npm)
Page 5405 of 6,664