Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
23,961 total in pypi · sorted newest first- Jul 21, 2026
Malicious code in capmonstercloudcliet (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in capmonstercloudcluodclient (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in capmonstercloudcliant (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in capmonstercloudclinet (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candypost (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candyload (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in capmonsterccloudclient (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candyurl (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candyrandom (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in capmonstercloudclent (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in canvas-crawler (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candymc (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candyvisa (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candytool (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candysuper (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in capmonsstercloudcliennt (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candymine (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candypyw (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candyram (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candypep (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candypong (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candyre (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candylib (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candypip (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in capmonstercloudclenet (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in callistopy (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in camera-kit (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in calculator-c08d6d50f5964131 (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in callapirequests (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in caixaequ2ahzoop (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in c8tks94kspjyhtb (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in cache-compat-utils (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candygrand (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in calc123lorc (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candycpu (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candyad (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candycontrol (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in calctestchristmas (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candyhttp (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candyencode (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candygui (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in calcnotepad (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candycc (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candygame (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candyint (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in calendar-extender (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in calccc (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in caas-jupyter-tools (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in calculatingtime (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in candyget (PyPI)
1 compromised version
Page 232 of 480