Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,011 total in npm · sorted newest first- Jun 17, 2026
Malicious code in @mastra/voice-aws-nova-sonic (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/voice-aws-nova-sonic
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/voice-openai (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/voice-google-gemini-live (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/voice-google (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/voice-google-gemini-live
1 compromised version
- Jun 17, 2026
Malware in @mastra/voice-google
1 compromised version
- Jun 17, 2026
Malware in @mastra/voice-openai
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/voice-openai-realtime (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/voice-openai-realtime
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/google-cloud-pubsub (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/e2b (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/google-cloud-pubsub
1 compromised version
- Jun 17, 2026
Malware in @mastra/e2b
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/daytona (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/blaxel (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/blaxel
1 compromised version
- Jun 17, 2026
Malware in @mastra/daytona
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/mcp-registry-registry (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/longmemeval (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/agent-builder (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/agent-builder
1 compromised version
- Jun 17, 2026
Malware in @mastra/longmemeval
1 compromised version
- Jun 17, 2026
Malware in @mastra/mcp-registry-registry
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/temporal (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/tavily (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/stagehand (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/stagehand
1 compromised version
- Jun 17, 2026
Malware in @mastra/tavily
1 compromised version
- Jun 17, 2026
Malware in @mastra/temporal
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/agent-browser (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/agent-browser
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/otel-exporter (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/otel-exporter
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/playground-ui (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/playground-ui
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/docker (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/docker
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/turbopuffer (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/turbopuffer
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/deployer-netlify (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/deployer-netlify
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/cursor (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/cursor
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/claude (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/claude
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/deployer-cloudflare (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/deployer-cloudflare
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/cloudflare (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/cloudflare
1 compromised version
Page 42 of 4,801