Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,331 total · sorted newest first- Aug 14, 2025
Malicious code in plugin-migrate (npm)
- Aug 14, 2025
Malicious code in plugin-image-generation (npm)
- Aug 14, 2025
Malicious code in plugin-graphql (npm)
- Aug 14, 2025
Malicious code in plugin-did-you-mean (npm)
- Aug 14, 2025
Malicious code in plugin-cloudflare (npm)
- Aug 14, 2025
Malicious code in plottable-moment (npm)
- Aug 14, 2025
Malicious code in plopgraph (npm)
- Aug 14, 2025
Malicious code in plne2 (npm)
- Aug 14, 2025
Malicious code in plistutil (npm)
- Aug 14, 2025
Malicious code in pli2 (npm)
- Aug 14, 2025
Malicious code in pleyus (npm)
- Aug 14, 2025
Malicious code in plex-slack-music-notifications (npm)
- Aug 14, 2025
Malicious code in plesae (npm)
- Aug 14, 2025
Malicious code in plejsbook (npm)
- Aug 14, 2025
Malicious code in pleiad (npm)
- Aug 14, 2025
Malicious code in playyit (npm)
- Aug 14, 2025
Malicious code in playxing (npm)
- Aug 14, 2025
Malicious code in playwright-slidev-fusion-kastra (npm)
- Aug 14, 2025
Malicious code in playwright-prettier-archaeoastronomy-thuban (npm)
- Aug 14, 2025
Malicious code in playwright-mutation-mysql-solis (npm)
- Aug 14, 2025
Malicious code in playwright-mocha-chai-dotenv-parse-variables (npm)
- Aug 14, 2025
Malicious code in playwright-husky-redis-selenology (npm)
- Aug 14, 2025
Malicious code in playwright-fornax-avior-achernar (npm)
- Aug 14, 2025
Malicious code in playsms (npm)
- Aug 14, 2025
Malicious code in playsite (npm)
- Aug 14, 2025
Malicious code in playready (npm)
- Aug 14, 2025
Malicious code in playinga (npm)
- Aug 14, 2025
Malicious code in playground-wizard (npm)
- Aug 14, 2025
Malicious code in playfair-display (npm)
- Aug 14, 2025
Malicious code in playerctl (npm)
- Aug 14, 2025
Malicious code in player2.1tv.com (npm)
- Aug 14, 2025
Malicious code in playapi.engines (npm)
- Aug 14, 2025
Malicious code in play-url (npm)
- Aug 14, 2025
Malicious code in platti (npm)
- Aug 14, 2025
Malicious code in platformized-filter-builder (npm)
- Aug 14, 2025
Malicious code in platformid (npm)
- Aug 14, 2025
Malicious code in platform-browser (npm)
- Aug 14, 2025
Malicious code in platform-boomerang-components (npm)
- Aug 14, 2025
Malicious code in plastik (npm)
- Aug 14, 2025
Malicious code in plantid (npm)
- Aug 14, 2025
Malicious code in planos (npm)
- Aug 14, 2025
Malicious code in planning-file-updater (npm)
- Aug 14, 2025
Malicious code in planmill-auth (npm)
- Aug 14, 2025
Malicious code in planetz (npm)
- Aug 14, 2025
Malicious code in planett-simple-ad-block (npm)
- Aug 14, 2025
Malicious code in planett-go-back-to-top-text (npm)
- Aug 14, 2025
Malicious code in planetology-warp-airbnb-norma (npm)
- Aug 14, 2025
Malicious code in planetology-server-optimize-css-assets-webpack-plugin-venus (npm)
- Aug 14, 2025
Malicious code in planetology-relay-antd-halley (npm)
- Aug 14, 2025
Malicious code in planetology-mutation-boson-warp (npm)
Page 5867 of 7,327