Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
23,914 total in pypi · sorted newest first- Mar 23, 2026
Malicious code in anduril-sdk (PyPI)
2 compromised versions
- Mar 22, 2026
Malicious code in pipinpeace-bind (PyPI)
1 compromised version
- Mar 22, 2026
Malicious code in pipinpeace-reverse (PyPI)
1 compromised version
- Mar 22, 2026
Malicious code in pipinpeace-env (PyPI)
1 compromised version
- Mar 21, 2026
Malicious code in aiolrucache (PyPI)
4 compromised versions
- Mar 21, 2026
Malicious code in thisismytest (PyPI)
5 compromised versions
- Mar 21, 2026
Malicious code in qyrm-pipinject4 (PyPI)
1 compromised version
- Mar 21, 2026
Malicious code in nump (PyPI)
4 compromised versions
- Mar 20, 2026
Malicious code in mangrove-sdk (PyPI)
1 compromised version
- Mar 20, 2026
Malicious code in efghr-honeybee-sdk (PyPI)
2 compromised versions
- Mar 20, 2026
Malicious code in flyio-token-client-efgh (PyPI)
1 compromised version
- Mar 20, 2026
Malicious code in tui-ascii-art (PyPI)
2 compromised versions
- Mar 20, 2026
Malicious code in indpack (PyPI)
1 compromised version
- Mar 20, 2026
Malicious code in reqpack (PyPI)
1 compromised version
- Mar 20, 2026
Malicious code in gcpipwrap (PyPI)
7 compromised versions
- Mar 20, 2026
Malicious code in nspack (PyPI)
8 compromised versions
- Mar 20, 2026
Malicious code in cfgmgr-sync (PyPI)
10 compromised versions
- Mar 20, 2026
Malicious code in cfgmgr-syn (PyPI)
2 compromised versions
- Mar 20, 2026
Malicious code in init2winit (PyPI)
1 compromised version
- Mar 20, 2026
Malicious code in airio (PyPI)
1 compromised version
- Mar 20, 2026
Malicious code in nsscache (PyPI)
1 compromised version
- Mar 20, 2026
Malicious code in spatialmedia (PyPI)
1 compromised version
- Mar 20, 2026
Malicious code in pubsub2inbox (PyPI)
1 compromised version
- Mar 20, 2026
Malicious code in perfkitbenchmarker (PyPI)
1 compromised version
- Mar 20, 2026
Malicious code in composer-dev (PyPI)
1 compromised version
- Mar 20, 2026
Malicious code in dataflux-pytorch (PyPI)
1 compromised version
- Mar 20, 2026
Malicious code in mcp-transport-proto (PyPI)
1 compromised version
- Mar 20, 2026
Malicious code in cloud-datasets (PyPI)
1 compromised version
- Mar 20, 2026
Malicious code in azure-eventhub-checkpointstoretable (PyPI)
1 compromised version
- Mar 19, 2026
Malicious code in libavcodec-extra (PyPI)
1 compromised version
- Mar 18, 2026
Malicious code in ropie (PyPI)
1 compromised version
- Mar 18, 2026
Malicious code in tabullate (PyPI)
1 compromised version
- Mar 18, 2026
Malicious code in suficloud (PyPI)
1 compromised version
- Mar 18, 2026
Malicious code in quantumania (PyPI)
1 compromised version
- Mar 18, 2026
Malicious code in prometheus-quicker-analysis (PyPI)
1 compromised version
- Mar 18, 2026
Malicious code in prometheus-quick-analysis (PyPI)
1 compromised version
- Mar 18, 2026
Malicious code in prometheus-fast-analysis (PyPI)
1 compromised version
- Mar 18, 2026
Malicious code in prometheus-analysis-1 (PyPI)
1 compromised version
- Mar 18, 2026
Malicious code in prometheus-analysis (PyPI)
3 compromised versions
- Mar 18, 2026
Malicious code in loveclose2 (PyPI)
1 compromised version
- Mar 18, 2026
Malicious code in loveclose1 (PyPI)
6 compromised versions
- Mar 18, 2026
Malicious code in loveclose (PyPI)
5 compromised versions
- Mar 18, 2026
Malicious code in loveahmedclose (PyPI)
10 compromised versions
- Mar 18, 2026
Malicious code in helloharry123t-package (PyPI)
1 compromised version
- Mar 18, 2026
Malicious code in ethical-demo-liviy (PyPI)
1 compromised version
- Mar 18, 2026
Malicious code in elleuchdhsolvepwn (PyPI)
1 compromised version
- Mar 18, 2026
Malicious code in discordrlbypasser (PyPI)
4 compromised versions
- Mar 18, 2026
Malicious code in curl-requester (PyPI)
1 compromised version
- Mar 18, 2026
Malicious code in bigmathutils (PyPI)
3 compromised versions
- Mar 18, 2026
Malicious code in bigmathix (PyPI)
3 compromised versions
Page 264 of 479