Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Aug 14, 2025
Malicious code in puppeteer-quantumfoam-fork-figures (npm)
- Aug 14, 2025
Malicious code in puppeteer-prettier-writable-tethys (npm)
- Aug 14, 2025
Malicious code in puppeteer-hyperion-jabbah-kastra (npm)
- Aug 14, 2025
Malicious code in puppeteer-exobiology-mira-higgs (npm)
- Aug 14, 2025
Malicious code in puppeteer-entanglement-geochronology-ursa (npm)
- Aug 14, 2025
Malicious code in puppeteer-dactyl-backend-zenith (npm)
- Aug 14, 2025
Malicious code in puppeteer-cluster-axios-standard (npm)
- Aug 14, 2025
Malicious code in puncuation (npm)
- Aug 14, 2025
Malicious code in pulse_wztzk_z9ypy_twilight (npm)
- Aug 14, 2025
Malicious code in pulse_v4geh_z4wnk_whirlwind (npm)
- Aug 14, 2025
Malicious code in pulse_qmwv4_3fhj4_banyan (npm)
- Aug 14, 2025
Malicious code in pulse_otsds_slv9v_vantage (npm)
- Aug 14, 2025
Malicious code in pulse_nrf9n_dez8s_maple (npm)
- Aug 14, 2025
Malicious code in pulse-aura-zqg679-project (npm)
- Aug 14, 2025
Malicious code in pulsar-zamia-0ql5 (npm)
- Aug 14, 2025
Malicious code in pulsar-wezen-nightwatch-jabbah (npm)
- Aug 14, 2025
Malicious code in pulsar-webdriverio-express-atlas (npm)
- Aug 14, 2025
Malicious code in pulsar-superposition-fomalhaut-on (npm)
- Aug 14, 2025
Malicious code in pulsar-spectron-mantle-webdriverio (npm)
- Aug 14, 2025
Malicious code in pulsar-solis-pino-pretty-dysonswarm (npm)
- Aug 14, 2025
Malicious code in pulsar-oscar-uv8l (npm)
- Aug 14, 2025
Malicious code in pulsar-november-00rh (npm)
- Aug 14, 2025
Malicious code in pulsar-mushroom-4e6b (npm)
- Aug 14, 2025
Malicious code in pulsar-kapok-nzom (npm)
- Aug 14, 2025
Malicious code in pulsar-foxtrot-0jay (npm)
- Aug 14, 2025
Malicious code in pulsar-elderberry-inbe (npm)
- Aug 14, 2025
Malicious code in pulsar-beetroot-jpe2 (npm)
- Aug 14, 2025
Malicious code in pulsanote (npm)
- Aug 14, 2025
Malicious code in pull-goth-lsk (npm)
- Aug 14, 2025
Malicious code in pug-i18n-loader (npm)
- Aug 14, 2025
Malicious code in pug-ctp-filter (npm)
- Aug 14, 2025
Malicious code in puffcorn (npm)
- Aug 14, 2025
Malicious code in pucclass (npm)
- Aug 14, 2025
Malicious code in pubtapper (npm)
- Aug 14, 2025
Malicious code in pubperz (npm)
- Aug 14, 2025
Malicious code in publish_anu1 (npm)
- Aug 14, 2025
Malicious code in publish-test-min-module (npm)
- Aug 14, 2025
Malicious code in publish-superagent-websockets-gulp (npm)
- Aug 14, 2025
Malicious code in publish-process-postcss-loader-protractor (npm)
- Aug 14, 2025
Malicious code in publish-link-sedna-html-webpack-plugin (npm)
- Aug 14, 2025
Malicious code in publish-jekyll-remark-uranology (npm)
- Aug 14, 2025
Malicious code in publish-biotechnology-update-cosmicray (npm)
- Aug 14, 2025
Malicious code in publictcp (npm)
- Aug 14, 2025
Malicious code in public-object-validate-user-decrypt (npm)
- Aug 14, 2025
Malicious code in public-mock-wind-xi-interface (npm)
- Aug 14, 2025
Malicious code in public-csv-carpo-cygnus (npm)
- Aug 14, 2025
Malicious code in public-config (npm)
- Aug 14, 2025
Malicious code in public-antares-leda-morgan (npm)
- Aug 14, 2025
Malicious code in pub_anu1 (npm)
- Aug 14, 2025
Malicious code in pu-schedule-connect (npm)
Page 5804 of 7,293