Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
23,933 total in pypi · sorted newest first- Jul 21, 2026
Malicious code in stripe-client-py (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in studycc (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in stripe-client (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in stripe-commands (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in strstyle (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in strpull (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in stringcc (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in strsuper (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in strcolrify (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in strreplace (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in stringrand (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in strload (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in stringintel (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in strbeautify (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in strgrand (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in stringgrand (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in strcolored (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in stringultra (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in strhydra (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in stripe-utils (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in stripepy (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in stripe-internal (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in strram (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in strpep (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in strstylle (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in strcolorize (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in stringhelp (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in strongkong (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in stringencode (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in strrandom (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in strinfo (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in studylib (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in steelseriesgen-api (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in starlette-healthcheck (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in sselenium (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in strands-agents-anthropic (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in springboot (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in ssolana (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in sqlalchemy-install (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in sscikit-learn (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in starexx (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in story-mcp-hub (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in stats-helpers (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in stake-auto-better (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in sscrapy (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in sqlalchemy-os (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in spotify2youtubemusic (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in spy-ai (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in sqligen (PyPI)
1 compromised version
- Jul 21, 2026
Malicious code in stackstorm-runner-action-chain (PyPI)
1 compromised version
Page 59 of 479