Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,197 total in npm · sorted newest first- Aug 14, 2025
Malicious code in proxible (npm)
- Aug 14, 2025
Malicious code in provis-locks (npm)
- Aug 14, 2025
Malicious code in provider-configurations (npm)
- Aug 14, 2025
Malicious code in protractor-html-screenshot-report (npm)
- Aug 14, 2025
Malicious code in protorina (npm)
- Aug 14, 2025
Malicious code in protorec (npm)
- Aug 14, 2025
Malicious code in protoplanetarydisk-rehype-vortex-koa (npm)
- Aug 14, 2025
Malicious code in protoplanetarydisk-quasarjet-radioastronomy-node-config (npm)
- Aug 14, 2025
Malicious code in protoplanetarydisk-plutology-lynx-kardashevscale (npm)
- Aug 14, 2025
Malicious code in protoplanetarydisk-decoherence-aquarius-parcel (npm)
- Aug 14, 2025
Malicious code in protoplanetarydisk-archaeometry-procyon-node-config (npm)
- Aug 14, 2025
Malicious code in protomon (npm)
- Aug 14, 2025
Malicious code in protogit (npm)
- Aug 14, 2025
Malicious code in proto-ui-shell-test (npm)
- Aug 14, 2025
Malicious code in proto-ui-shell (npm)
- Aug 14, 2025
Malicious code in proto-offering-module (npm)
- Aug 14, 2025
Malicious code in proteusdns (npm)
- Aug 14, 2025
Malicious code in proteomics-vulcan-venus-buffer (npm)
- Aug 14, 2025
Malicious code in proteomics-spectron-chromedriver-package (npm)
- Aug 14, 2025
Malicious code in proteomics-spawn-upgrade-parallax (npm)
- Aug 14, 2025
Malicious code in proteomics-perturbation-weywot-areology (npm)
- Aug 14, 2025
Malicious code in proteomics-parallax-parallax-wasat (npm)
- Aug 14, 2025
Malicious code in proteomics-link-promise-callisto (npm)
- Aug 14, 2025
Malicious code in proteomics-hercules-public-gatsby (npm)
- Aug 14, 2025
Malicious code in protected-emulate-star-fire-load (npm)
- Aug 14, 2025
Malicious code in protect-api (npm)
- Aug 14, 2025
Malicious code in prosthetics-janus-decoherence-xanthus (npm)
- Aug 14, 2025
Malicious code in prosthetics-commitlint-config-angular-dotenv-safe-supervisor (npm)
- Aug 14, 2025
Malicious code in prosoft-ui (npm)
- Aug 14, 2025
Malicious code in prosoft-hapi-winston-logger (npm)
- Aug 14, 2025
Malicious code in prosoft-crm-widgets (npm)
- Aug 14, 2025
Malicious code in propyminer (npm)
- Aug 14, 2025
Malicious code in propertify (npm)
- Aug 14, 2025
Malicious code in propardi (npm)
- Aug 14, 2025
Malicious code in PropagAPISpecification (npm)
- Aug 14, 2025
Malicious code in propag (npm)
- Aug 14, 2025
Malicious code in prop-ytpes (npm)
- Aug 14, 2025
Malicious code in prop-tyeps (npm)
- Aug 14, 2025
Malicious code in proovitoo (npm)
- Aug 14, 2025
Malicious code in prompts-lepton-auth-standard (npm)
- Aug 14, 2025
Malicious code in prompts-auth-oauth-markdown-pdf (npm)
- Aug 14, 2025
Malicious code in promoter-ninja (npm)
- Aug 14, 2025
Malicious code in promonews (npm)
- Aug 14, 2025
Malicious code in promise-xo-umbriel-start (npm)
- Aug 14, 2025
Malicious code in promise-vega-react-bootstrap-blueshift (npm)
- Aug 14, 2025
Malicious code in promise-stratosphere-prettier-plugin-markdown-proxima (npm)
- Aug 14, 2025
Malicious code in promise-query-semantic-release-cosmochemistry (npm)
- Aug 14, 2025
Malicious code in promise-ora-postcss-antares (npm)
- Aug 14, 2025
Malicious code in promise-mongodb-connection-factory (npm)
- Aug 14, 2025
Malicious code in promise-mineralogy-dagda-winston (npm)
Page 5406 of 6,664