Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
23,914 total in pypi · sorted newest first- May 2, 2026
Malicious code in apexomni-client (PyPI)
1 compromised version
- May 2, 2026
Malicious code in currenttimerlib (PyPI)
1 compromised version
- May 2, 2026
Malicious code in currenttimerpy (PyPI)
1 compromised version
- May 2, 2026
Malicious code in timermcp (PyPI)
1 compromised version
- May 2, 2026
Malicious code in as89ufnaisufn (PyPI)
1 compromised version
- May 2, 2026
Malicious code in timingmcp (PyPI)
1 compromised version
- May 2, 2026
Malicious code in timesmcp (PyPI)
1 compromised version
- May 2, 2026
Malicious code in ziugxfbvo (PyPI)
1 compromised version
- May 1, 2026
Malicious code in graphicctx (PyPI)
1 compromised version
- May 1, 2026
Malicious code in oracle-lag-sniper (PyPI)
1 compromised version
- May 1, 2026
Malicious code in graphicsctxs (PyPI)
1 compromised version
- May 1, 2026
Malicious code in aocl-sparse-v2 (PyPI)
1 compromised version
- May 1, 2026
Malicious code in py-clob-clients (PyPI)
7 compromised versions
- May 1, 2026
Malicious code in tns-py (PyPI)
1 compromised version
- May 1, 2026
Malicious code in aocl-sparse (PyPI)
1 compromised version
- May 1, 2026
Malicious code in my-pipeline-watcher-poc (PyPI)
1 compromised version
- May 1, 2026
Malicious code in httpx-utils (PyPI)
1 compromised version
- May 1, 2026
Malicious code in renderkitcore (PyPI)
1 compromised version
- May 1, 2026
Malicious code in funkratov-renderkit (PyPI)
1 compromised version
- May 1, 2026
Malicious code in chalk-fancy (PyPI)
9 compromised versions
- May 1, 2026
Malicious code in pycryptcore (PyPI)
4 compromised versions
- May 1, 2026
Malicious code in graphicsctxr (PyPI)
8 compromised versions
- May 1, 2026
Malicious code in bxiucnxcb (PyPI)
1 compromised version
- Apr 30, 2026
Malicious code in currentclock (PyPI)
1 compromised version
- Apr 30, 2026
Malicious code in renderctx (PyPI)
6 compromised versions
- Apr 30, 2026
Malicious code in doisomgcxog (PyPI)
1 compromised version
- Apr 30, 2026
Malicious code in buffparser (PyPI)
1 compromised version
- Apr 30, 2026
Malicious code in lightning (PyPI)
2 compromised versions
- Apr 30, 2026
Malicious code in timecurrently (PyPI)
1 compromised version
- Apr 30, 2026
Malicious code in sdoihgio9sudghsiudbg (PyPI)
1 compromised version
- Apr 30, 2026
Malicious code in robase-dnb (PyPI)
1 compromised version
- Apr 29, 2026
Malicious code in rblx-http (PyPI)
1 compromised version
- Apr 29, 2026
Malicious code in rblx-https (PyPI)
1 compromised version
- Apr 29, 2026
Malicious code in ro-db (PyPI)
1 compromised version
- Apr 29, 2026
Malicious code in bbranger (PyPI)
1 compromised version
- Apr 29, 2026
Malicious code in amazon-boto (PyPI)
2 compromised versions
- Apr 29, 2026
Malicious code in timenow-py (PyPI)
1 compromised version
- Apr 29, 2026
Malicious code in timenow (PyPI)
1 compromised version
- Apr 29, 2026
Malicious code in timemcp-utils (PyPI)
1 compromised version
- Apr 29, 2026
Malicious code in timemcp190825790125120985125 (PyPI)
1 compromised version
- Apr 29, 2026
Malicious code in timemcp-client (PyPI)
1 compromised version
- Apr 29, 2026
Malicious code in coinmate-api (PyPI)
1 compromised version
- Apr 28, 2026
Malicious code in core-roblox-utils (PyPI)
1 compromised version
- Apr 28, 2026
Malicious code in robase-start (PyPI)
1 compromised version
- Apr 28, 2026
Malicious code in robase-apis (PyPI)
1 compromised version
- Apr 28, 2026
Malicious code in sf-th-requests (PyPI)
2 compromised versions
- Apr 28, 2026
Malicious code in timestamp-py (PyPI)
1 compromised version
- Apr 28, 2026
Malicious code in timemcp-py (PyPI)
1 compromised version
- Apr 28, 2026
Malicious code in fetchapi-syncdata-pypi (PyPI)
1 compromised version
- Apr 28, 2026
Malicious code in timemcp (PyPI)
1 compromised version
Page 258 of 479