Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Aug 14, 2025
Malicious code in proteomics-hercules-public-gatsby (npm)
- Aug 14, 2025
Malicious code in protected-emulate-star-fire-load (npm)
- Aug 14, 2025
Malicious code in protect-api (npm)
- Aug 14, 2025
Malicious code in prosthetics-janus-decoherence-xanthus (npm)
- Aug 14, 2025
Malicious code in prosthetics-commitlint-config-angular-dotenv-safe-supervisor (npm)
- Aug 14, 2025
Malicious code in prosoft-ui (npm)
- Aug 14, 2025
Malicious code in prosoft-hapi-winston-logger (npm)
- Aug 14, 2025
Malicious code in prosoft-crm-widgets (npm)
- Aug 14, 2025
Malicious code in propyminer (npm)
- Aug 14, 2025
Malicious code in propertify (npm)
- Aug 14, 2025
Malicious code in propardi (npm)
- Aug 14, 2025
Malicious code in PropagAPISpecification (npm)
- Aug 14, 2025
Malicious code in propag (npm)
- Aug 14, 2025
Malicious code in prop-ytpes (npm)
- Aug 14, 2025
Malicious code in prop-tyeps (npm)
- Aug 14, 2025
Malicious code in proovitoo (npm)
- Aug 14, 2025
Malicious code in prompts-lepton-auth-standard (npm)
- Aug 14, 2025
Malicious code in prompts-auth-oauth-markdown-pdf (npm)
- Aug 14, 2025
Malicious code in promoter-ninja (npm)
- Aug 14, 2025
Malicious code in promonews (npm)
- Aug 14, 2025
Malicious code in promise-xo-umbriel-start (npm)
- Aug 14, 2025
Malicious code in promise-vega-react-bootstrap-blueshift (npm)
- Aug 14, 2025
Malicious code in promise-stratosphere-prettier-plugin-markdown-proxima (npm)
- Aug 14, 2025
Malicious code in promise-query-semantic-release-cosmochemistry (npm)
- Aug 14, 2025
Malicious code in promise-ora-postcss-antares (npm)
- Aug 14, 2025
Malicious code in promise-mongodb-connection-factory (npm)
- Aug 14, 2025
Malicious code in promise-mineralogy-dagda-winston (npm)
- Aug 14, 2025
Malicious code in promise-element-ui-relay-json (npm)
- Aug 14, 2025
Malicious code in promise-cron-key-sudo-analyze (npm)
- Aug 14, 2025
Malicious code in promin (npm)
- Aug 14, 2025
Malicious code in prometheus-stats-library (npm)
- Aug 14, 2025
Malicious code in promap (npm)
- Aug 14, 2025
Malicious code in proloquo (npm)
- Aug 14, 2025
Malicious code in proliphiq (npm)
- Aug 14, 2025
Malicious code in projetvls (npm)
- Aug 14, 2025
Malicious code in projetrpg (npm)
- Aug 14, 2025
Malicious code in projetoip (npm)
- Aug 14, 2025
Malicious code in projetnao (npm)
- Aug 14, 2025
Malicious code in projetbdr (npm)
- Aug 14, 2025
Malicious code in projektor (npm)
- Aug 14, 2025
Malicious code in projectn (npm)
- Aug 14, 2025
Malicious code in project-zzeq7-vanilla (npm)
- Aug 14, 2025
Malicious code in project-zxjhb-watermelon (npm)
- Aug 14, 2025
Malicious code in project-zxbm3-yam (npm)
- Aug 14, 2025
Malicious code in project-zvw9j-banana (npm)
- Aug 14, 2025
Malicious code in project-zuplm-victor (npm)
- Aug 14, 2025
Malicious code in project-zsdvd-hotel (npm)
- Aug 14, 2025
Malicious code in project-zpzcn-honeydew (npm)
- Aug 14, 2025
Malicious code in project-zpvl7-lemon (npm)
- Aug 14, 2025
Malicious code in project-zphqv-victor (npm)
Page 5806 of 7,293