Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,011 total in npm · sorted newest first- Jun 17, 2026
Malicious code in @mastra/pinecone (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/pinecone
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/deployer-vercel (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/deployer-vercel
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/upstash (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/upstash
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/s3vectors (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/s3vectors
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/convex (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/convex
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/vectorize (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/vectorize
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/qdrant (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/qdrant
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/chroma (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/chroma
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/couchbase (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/couchbase
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/cloudflare-d1 (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/auth-better-auth (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/cloudflare-d1
1 compromised version
- Jun 17, 2026
Malware in @mastra/auth-better-auth
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/dsql (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/auth-workos (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/auth-auth0 (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/dsql
1 compromised version
- Jun 17, 2026
Malware in @mastra/auth-workos
1 compromised version
- Jun 17, 2026
Malware in @mastra/auth-auth0
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/mssql (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/mssql
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/auth-supabase (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/auth-supabase
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/auth-clerk (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/auth-clerk
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/koa (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/koa
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/express (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/express
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/nestjs (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/nestjs
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/server (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/memory (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/client-js (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/server
1 compromised version
- Jun 17, 2026
Malware in @mastra/memory
1 compromised version
- Jun 17, 2026
Malware in @mastra/client-js
1 compromised version
- Jun 17, 2026
Malicious code in create-mastra (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/deployer (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/core (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/deployer
1 compromised version
Page 43 of 4,801