Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
7,885 total in gem · sorted newest first- Jul 7, 2026
Malicious code in aicalojdhdxoa (RubyGems)
1 compromised version
- Jul 7, 2026
Malicious code in aicalllngxwwh (RubyGems)
1 compromised version
- Jul 7, 2026
Malicious code in agfossstd21 (RubyGems)
1 compromised version
- Jul 7, 2026
Malicious code in agfosssacre22 (RubyGems)
1 compromised version
- Jul 7, 2026
Malicious code in agfosslic24 (RubyGems)
1 compromised version
- Jul 7, 2026
Malicious code in agfossgrant23 (RubyGems)
1 compromised version
- Jul 7, 2026
Malicious code in agfosscab20 (RubyGems)
1 compromised version
- Jul 7, 2026
Malicious code in agentoaitestabc123 (RubyGems)
1 compromised version
- Jul 7, 2026
Malicious code in abcfoobar1778550632348198 (RubyGems)
1 compromised version
- Jul 7, 2026
Malicious code in abcfoobar1778550629075869 (RubyGems)
1 compromised version
- Jul 7, 2026
Malicious code in abcfoobar1778550625683711 (RubyGems)
1 compromised version
- Jul 7, 2026
Malicious code in a0a_arcgraph (RubyGems)
4 compromised versions
- Jul 7, 2026
Malicious code in a00_arcguide (RubyGems)
1 compromised version
- Jun 18, 2026
Malicious code in final-poc-usa (RubyGems)
1 compromised version
- Jun 18, 2026
Malicious code in final-shoaib (RubyGems)
1 compromised version
- Jun 1, 2026
Malicious code in align_rest_api (RubyGems)
1 compromised version
- May 13, 2026
Malicious code in knot-simple-formatter (RubyGems)
1 compromised version
- May 13, 2026
Malicious code in knot-rspec-formatter-json (RubyGems)
1 compromised version
- May 13, 2026
Malicious code in knot-rails-assets-pipeline (RubyGems)
1 compromised version
- May 13, 2026
Malicious code in knot-rack-session-store (RubyGems)
1 compromised version
- May 13, 2026
Malicious code in knot-devise-jwt-helper (RubyGems)
1 compromised version
- May 13, 2026
Malicious code in knot-date-utils-rb (RubyGems)
1 compromised version
- May 13, 2026
Malicious code in knot-activesupport-logger (RubyGems)
1 compromised version
- Apr 16, 2026
Malicious code in monolith-twirp-pullsd-users (RubyGems)
2 compromised versions
- Apr 16, 2026
Malicious code in monolith-twirp-pullsd-authorization (RubyGems)
2 compromised versions
- Apr 16, 2026
Malicious code in gitlab-orchestrator (RubyGems)
2 compromised versions
- Mar 27, 2026
Malicious code in monolith-twirp-codingagentintegrations-codingagentintegrations (RubyGems)
1 compromised version
- Mar 27, 2026
Malicious code in monolith-twirp-copilot-registry (RubyGems)
1 compromised version
- Mar 27, 2026
Malicious code in monolith-twirp-partitioning-pull_requests (RubyGems)
1 compromised version
- Mar 27, 2026
Malicious code in monolith-twirp-reposinsights-reposinsights (RubyGems)
1 compromised version
- Mar 27, 2026
Malicious code in monolith-twirp-pullsd-teams (RubyGems)
1 compromised version
- Mar 27, 2026
Malicious code in monolith-twirp-loops-core (RubyGems)
1 compromised version
- Mar 27, 2026
Malicious code in monolith-twirp-pullsd-repositories (RubyGems)
1 compromised version
- Mar 27, 2026
Malicious code in monolith-twirp-pullsd-pullrequestinfo (RubyGems)
1 compromised version
- Mar 27, 2026
Malicious code in monolith-twirp-scribe-scribe (RubyGems)
1 compromised version
- Mar 24, 2026
Malicious code in plugin-gem-example (RubyGems)
2 compromised versions
- Mar 18, 2026
Malicious code in testcatplzignore (RubyGems)
1 compromised version
- Mar 18, 2026
Malicious code in sq-minimal-feature-flags (RubyGems)
1 compromised version
- Mar 18, 2026
Malicious code in rubylogger (RubyGems)
4 compromised versions
- Mar 18, 2026
Malicious code in resolvrtest (RubyGems)
1 compromised version
- Mar 18, 2026
Malicious code in rails_structured_logging (RubyGems)
7 compromised versions
- Mar 18, 2026
Malicious code in rafka-rb (RubyGems)
1 compromised version
- Mar 18, 2026
Malicious code in newlogger (RubyGems)
2 compromised versions
- Mar 18, 2026
Malicious code in kaleido (RubyGems)
1 compromised version
- Mar 18, 2026
Malicious code in freshworks-ruby (RubyGems)
1 compromised version
- Mar 18, 2026
Malicious code in doctolib (RubyGems)
5 compromised versions
- Feb 23, 2026
Malicious code in newrubylogger (RubyGems)
1 compromised version
- Feb 20, 2026
Malicious code in rubocop-vintedmetrics (RubyGems)
2 compromised versions
- Feb 15, 2026
Malicious code in cucumber_json_schema (RubyGems)
1 compromised version
- Dec 23, 2025
Malicious code in verificator (RubyGems)
1 compromised version
Page 139 of 158