Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
23,914 total in pypi · sorted newest first- Jun 11, 2026
Malicious code in trongap (PyPI)
1 compromised version
- Jun 11, 2026
Malicious code in bittensor-burn-message (PyPI)
1 compromised version
- Jun 11, 2026
Malicious code in pylogxo (PyPI)
2 compromised versions
- Jun 11, 2026
Malicious code in bibip-bip (PyPI)
1 compromised version
- Jun 11, 2026
Malicious code in acme-widget-layout-utils (PyPI)
3 compromised versions
- Jun 10, 2026
Malicious code in icinga (PyPI)
2 compromised versions
- Jun 10, 2026
Malicious code in telegramlite (PyPI)
2 compromised versions
- Jun 10, 2026
Malicious code in hello-dynamic (PyPI)
3 compromised versions
- Jun 10, 2026
Malicious code in requests-toolbelt-plus (PyPI)
4 compromised versions
- Jun 9, 2026
Malicious code in bittensor-emission-tracker (PyPI)
1 compromised version
- Jun 9, 2026
durabletask 1.4.1, 1.4.2, and 1.4.3 contain malicious code distributed via a compromised maintainer account
3 compromised versions
- Jun 9, 2026
Malicious code in tao-subnet-metrics (PyPI)
1 compromised version
- Jun 9, 2026
Malicious code in ultimate-ai-power (PyPI)
1 compromised version
- Jun 9, 2026
Malicious code in cubifyanything (PyPI)
3 compromised versions
- Jun 9, 2026
Malicious code in dstill (PyPI)
1 compromised version
- Jun 8, 2026
Malicious code in xfoofoox (PyPI)
1 compromised version
- Jun 8, 2026
Malicious code in solana-web3-py (PyPI)
1 compromised version
- Jun 8, 2026
Malicious code in solana-cli-py (PyPI)
1 compromised version
- Jun 8, 2026
Malicious code in solana-web3 (PyPI)
1 compromised version
- Jun 8, 2026
Malicious code in spl-token-py (PyPI)
1 compromised version
- Jun 8, 2026
Malicious code in xfoobar (PyPI)
1 compromised version
- Jun 8, 2026
Malicious code in spaysrbx (PyPI)
1 compromised version
- Jun 8, 2026
Malicious code in nerfstudio-gs (PyPI)
4 compromised versions
- Jun 8, 2026
Malicious code in bittensor-burn (PyPI)
2 compromised versions
- Jun 8, 2026
Malicious code in xforpy (PyPI)
4 compromised versions
- Jun 8, 2026
Malicious code in odoo-addon-spp-base (PyPI)
1 compromised version
- Jun 8, 2026
Malicious code in bittensor-burn-alert (PyPI)
3 compromised versions
- Jun 8, 2026
Malicious code in spaysdatarbx (PyPI)
2 compromised versions
- Jun 8, 2026
Malicious code in bt-burn-watch (PyPI)
1 compromised version
- Jun 8, 2026
Malicious code in bittensor-burn-monitor (PyPI)
7 compromised versions
- Jun 8, 2026
Malicious code in openai-mcp (PyPI)
2 compromised versions
- Jun 8, 2026
Malicious code in tiktoken-mcp (PyPI)
2 compromised versions
- Jun 8, 2026
Malicious code in tlask (PyPI)
2 compromised versions
- Jun 8, 2026
Malicious code in rlask (PyPI)
5 compromised versions
- Jun 8, 2026
Malicious code in rsquests (PyPI)
2 compromised versions
- Jun 8, 2026
Malicious code in nhmpy (PyPI)
2 compromised versions
- Jun 7, 2026
Malicious code in bittensor-burn-watch (PyPI)
16 compromised versions
- Jun 7, 2026
Malicious code in clip-logger (PyPI)
8 compromised versions
- Jun 6, 2026
Malicious code in ray-mcp-server (PyPI)
1 compromised version
- Jun 6, 2026
Malicious code in pyphetools (PyPI)
1 compromised version
- Jun 6, 2026
Malicious code in ppkt2synergy (PyPI)
1 compromised version
- Jun 6, 2026
Malicious code in phenopacket-store-toolkit (PyPI)
1 compromised version
- Jun 6, 2026
Malicious code in orchestr8-platform (PyPI)
1 compromised version
- Jun 6, 2026
Malicious code in mem8 (PyPI)
1 compromised version
- Jun 6, 2026
Malicious code in langchain-core-mcp (PyPI)
2 compromised versions
- Jun 6, 2026
Malicious code in instructor-mcp (PyPI)
2 compromised versions
- Jun 6, 2026
Malicious code in gpsea (PyPI)
1 compromised version
- Jun 6, 2026
Malicious code in ensmallen (PyPI)
1 compromised version
- Jun 6, 2026
Malicious code in embiggen (PyPI)
1 compromised version
- Jun 6, 2026
Malicious code in dreamgen (PyPI)
1 compromised version
Page 252 of 479