Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,331 total · sorted newest first- Aug 14, 2025
Malicious code in poxel-server (npm)
- Aug 14, 2025
Malicious code in poxel (npm)
- Aug 14, 2025
Malicious code in powwow-logger (npm)
- Aug 14, 2025
Malicious code in powser (npm)
- Aug 14, 2025
Malicious code in powervu-mfc (npm)
- Aug 14, 2025
Malicious code in powervu (npm)
- Aug 14, 2025
Malicious code in powershop (npm)
- Aug 14, 2025
Malicious code in powerquery-parser (npm)
- Aug 14, 2025
Malicious code in powerext (npm)
- Aug 14, 2025
Malicious code in powerbi-visuals-test2 (npm)
- Aug 14, 2025
Malicious code in powerbi-client-beta (npm)
- Aug 14, 2025
Malicious code in postreach (npm)
- Aug 14, 2025
Malicious code in postrace (npm)
- Aug 14, 2025
Malicious code in postmarko (npm)
- Aug 14, 2025
Malicious code in postgres-rocket-install-postcss (npm)
- Aug 14, 2025
Malicious code in postgres-child-process-package-arcturus (npm)
- Aug 14, 2025
Malicious code in postgres-astroinformatics-janus-mocha (npm)
- Aug 14, 2025
Malicious code in postcss-url-inline-base64 (npm)
- Aug 14, 2025
Malicious code in postcss-passport-phenomic-axios (npm)
- Aug 14, 2025
Malicious code in postcss-minify2 (npm)
- Aug 14, 2025
Malicious code in postcss-minify-browser (npm)
- Aug 14, 2025
Malicious code in postcss-loader-remark-archaeoastronomy-nconf (npm)
- Aug 14, 2025
Malicious code in postcss-loader-graphql-tachyon-cors (npm)
- Aug 14, 2025
Malicious code in postcss-loader-express-init-test (npm)
- Aug 14, 2025
Malicious code in postcss-loader-dotenv-safe-mini-css-extract-plugin-supervisor (npm)
- Aug 14, 2025
Malicious code in postcss-iota-perseus-mira (npm)
- Aug 14, 2025
Malicious code in postcss-gemini-sedna-markdownlint (npm)
- Aug 14, 2025
Malicious code in postcss-darkenergy-hermes-resolvers (npm)
- Aug 14, 2025
Malicious code in postcss-css-prefixer (npm)
- Aug 14, 2025
Malicious code in postcss-cordelia-mutation-cz-conventional-changelog (npm)
- Aug 14, 2025
Malicious code in postcss-blaze-hermes-wolf (npm)
- Aug 14, 2025
Malicious code in post-purchase-ui-react (npm)
- Aug 14, 2025
Malicious code in post-data (npm)
- Aug 14, 2025
Malicious code in posionfor2 (npm)
- Aug 14, 2025
Malicious code in portsdemo (npm)
- Aug 14, 2025
Malicious code in portionfatty12 (npm)
- Aug 14, 2025
Malicious code in portflora (npm)
- Aug 14, 2025
Malicious code in portapoll (npm)
- Aug 14, 2025
Malicious code in portaless (npm)
- Aug 14, 2025
Malicious code in portalcgp (npm)
- Aug 14, 2025
Malicious code in portal-shared-library (npm)
- Aug 14, 2025
Malicious code in portableonboarding (npm)
- Aug 14, 2025
Malicious code in porp-types (npm)
- Aug 14, 2025
Malicious code in porifera (npm)
- Aug 14, 2025
Malicious code in popuptest (npm)
- Aug 14, 2025
Malicious code in popular (npm)
- Aug 14, 2025
Malicious code in popperscoolers.com (npm)
- Aug 14, 2025
Malicious code in popolni (npm)
- Aug 14, 2025
Malicious code in popguessr (npm)
- Aug 14, 2025
Malicious code in popayanjs (npm)
Page 5864 of 7,327