Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
3,510 total in gem · sorted newest first- Sep 1, 2025
Malicious code in monolith-twirp-spokesd-core (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in monolith-twirp-features-core (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in monolith-twirp-snippy-snippy (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in monolith-twirp-registrymetadata-core (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in sarif (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in monolith-twirp-trusttiers-trusttier (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in monolith-twirp-proxima-enterprisemanagement (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in monolith-twirp-notifications-notifyd (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in proto-registry-metadata-api (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in proto-dependency-graph-api (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in monolith-twirp-octoshift-migrations (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in spamurai-dev-kit (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in github-proto-repositories (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in actions-runner-admin (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in actions-run-service (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in chatterbox-client (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in diet_earthsmoke (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in blackbird-analysis (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in github-kv (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in github-orca (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in blackbird-client (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in authnd-client (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in driftwood-client (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in aqueduct-client (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in feature-flags-client (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in badge-ruler (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in diff-analysis (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in dependency-graph-platform-proto (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in delorean_client (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in actions-broker (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in console_auth (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in egress (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in dependency-snapshots-api-proto (RubyGems)
1 compromised version
- Sep 1, 2025
Malicious code in github-kredz (RubyGems)
1 compromised version
- Aug 28, 2025
Malicious code in omniauth-pro-sante-connect (RubyGems)
9 compromised versions
- Jul 31, 2025
Malicious code in webpack-dev-server (RubyGems)
5 compromised versions
- Jul 31, 2025
Malicious code in maventa_utils (RubyGems)
2 compromised versions
- Jul 31, 2025
Malicious code in maventa_common (RubyGems)
3 compromised versions
- Jul 31, 2025
Malicious code in icare (RubyGems)
1 compromised version
- Jul 31, 2025
Malicious code in icaret (RubyGems)
1 compromised version
- Jul 30, 2025
Malicious code in resource_registry (RubyGems)
2 compromised versions
- Jul 27, 2025
Malicious code in message_gateway (RubyGems)
1 compromised version
- Jun 18, 2025
Malicious code in xxxxxxxx (RubyGems)
1 compromised version
- Jun 18, 2025
Malicious code in teaspoon-devkit (RubyGems)
2 compromised versions
- Jun 18, 2025
Malicious code in jdbc-zzz (RubyGems)
1 compromised version
- Apr 24, 2025
Malicious code in bvr-api (RubyGems)
1 compromised version
- Mar 28, 2025
Malicious code in evenote-thrift (RubyGems)
10 compromised versions
- Mar 6, 2025
Malicious code in poc-by-shahwar (RubyGems)
1 compromised version
- Mar 6, 2025
Malicious code in poc-genrateed-by-noob (RubyGems)
1 compromised version
- Mar 6, 2025
Malicious code in evil_gem (RubyGems)
1 compromised version
Page 54 of 71