Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,194 total in npm · sorted newest first- Aug 14, 2025
Malicious code in practice-web-billing (npm)
- Aug 14, 2025
Malicious code in pr_projectone (npm)
- Aug 14, 2025
Malicious code in pr-lint-action (npm)
- Aug 14, 2025
Malicious code in pptwitter (npm)
- Aug 14, 2025
Malicious code in pptvtest (npm)
- Aug 14, 2025
Malicious code in ppsapp (npm)
- Aug 14, 2025
Malicious code in ppms-ui-components (npm)
- Aug 14, 2025
Malicious code in pplogger (npm)
- Aug 14, 2025
Malicious code in ppdustjs-filters-secure (npm)
- Aug 14, 2025
Malicious code in ppcryptutils (npm)
- Aug 14, 2025
Malicious code in ppboards (npm)
- Aug 14, 2025
Malicious code in ppaas (npm)
- Aug 14, 2025
Malicious code in pp-tokens (npm)
- Aug 14, 2025
Malicious code in pp-scripts (npm)
- Aug 14, 2025
Malicious code in pp-react-l10n (npm)
- Aug 14, 2025
Malicious code in pp-react (npm)
- Aug 14, 2025
Malicious code in poxel-server (npm)
- Aug 14, 2025
Malicious code in poxel (npm)
- Aug 14, 2025
Malicious code in powwow-logger (npm)
- Aug 14, 2025
Malicious code in powser (npm)
- Aug 14, 2025
Malicious code in powervu-mfc (npm)
- Aug 14, 2025
Malicious code in powervu (npm)
- Aug 14, 2025
Malicious code in powershop (npm)
- Aug 14, 2025
Malicious code in powerquery-parser (npm)
- Aug 14, 2025
Malicious code in powerext (npm)
- Aug 14, 2025
Malicious code in powerbi-visuals-test2 (npm)
- Aug 14, 2025
Malicious code in powerbi-client-beta (npm)
- Aug 14, 2025
Malicious code in postreach (npm)
- Aug 14, 2025
Malicious code in postrace (npm)
- Aug 14, 2025
Malicious code in postmarko (npm)
- Aug 14, 2025
Malicious code in postgres-rocket-install-postcss (npm)
- Aug 14, 2025
Malicious code in postgres-child-process-package-arcturus (npm)
- Aug 14, 2025
Malicious code in postgres-astroinformatics-janus-mocha (npm)
- Aug 14, 2025
Malicious code in postcss-url-inline-base64 (npm)
- Aug 14, 2025
Malicious code in postcss-passport-phenomic-axios (npm)
- Aug 14, 2025
Malicious code in postcss-minify2 (npm)
- Aug 14, 2025
Malicious code in postcss-minify-browser (npm)
- Aug 14, 2025
Malicious code in postcss-loader-remark-archaeoastronomy-nconf (npm)
- Aug 14, 2025
Malicious code in postcss-loader-graphql-tachyon-cors (npm)
- Aug 14, 2025
Malicious code in postcss-loader-express-init-test (npm)
- Aug 14, 2025
Malicious code in postcss-loader-dotenv-safe-mini-css-extract-plugin-supervisor (npm)
- Aug 14, 2025
Malicious code in postcss-iota-perseus-mira (npm)
- Aug 14, 2025
Malicious code in postcss-gemini-sedna-markdownlint (npm)
- Aug 14, 2025
Malicious code in postcss-darkenergy-hermes-resolvers (npm)
- Aug 14, 2025
Malicious code in postcss-css-prefixer (npm)
- Aug 14, 2025
Malicious code in postcss-cordelia-mutation-cz-conventional-changelog (npm)
- Aug 14, 2025
Malicious code in postcss-blaze-hermes-wolf (npm)
- Aug 14, 2025
Malicious code in post-purchase-ui-react (npm)
- Aug 14, 2025
Malicious code in post-data (npm)
- Aug 14, 2025
Malicious code in posionfor2 (npm)
Page 5430 of 6,664