Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
23,914 total in pypi · sorted newest first- Aug 28, 2025
Malicious code in tkinnter (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in this-is-vvvv (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in tf-nightly-2-0-preview (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in testcase100 (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in test-tetdssa (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in telemaster (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in telegrampremiumfix (PyPI)
5 compromised versions
- Aug 28, 2025
Malicious code in steembase (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in spykes (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in spoof-user-agent (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in speedyrequests (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in some-other-package (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in solution-maker (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in smartsheet (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in scraperworldapi (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in sample-module (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in rubyreq (PyPI)
4 compromised versions
- Aug 28, 2025
Malicious code in rtxt-dep1 (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in rsacracker (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in rqrqrq (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in rq-websites (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in ros2-demo-py (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in rickquests (PyPI)
3 compromised versions
- Aug 28, 2025
Malicious code in reversepkg (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in requests-util (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in requests-beta (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in requests-2022 (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in request-util (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in requesgs (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in requeqts (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in reqeuest-new (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in reqeuest-2022 (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in reqests-2022 (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in reqest-2022 (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in regexparam (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in rbx-cookie (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in rbx-autohit (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in rblxsetup (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in pyxhttp (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in pythonsftpservermanuel (PyPI)
10 compromised versions
- Aug 28, 2025
Malicious code in pythonroblox (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in python-kudu (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in python-eicar (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in python-dependency-confusion-attacks (PyPI)
3 compromised versions
- Aug 28, 2025
Malicious code in pyswyfter (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in pyscapes (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in py4self (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in prometheus-api-metrics (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in pkproxy (PyPI)
1 compromised version
- Aug 28, 2025
Malicious code in peloton-clients (PyPI)
1 compromised version
Page 278 of 479