Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
256,077 total · sorted newest first- Jun 17, 2026
Malicious code in easy-day-js (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @public-for-cdao/hooks (npm)
1 compromised version
- Jun 17, 2026
Malicious code in cryptodao-contracts (npm)
1 compromised version
- Jun 17, 2026
Malicious code in cryptodao-core (npm)
1 compromised version
- Jun 17, 2026
Malicious code in cryptodao-bot (npm)
1 compromised version
- Jun 17, 2026
Malicious code in cryptodao-utils (npm)
1 compromised version
- Jun 17, 2026
Malicious code in cryptodao-signer (npm)
1 compromised version
- Jun 17, 2026
Malicious code in cryptodao-deploy (npm)
1 compromised version
- Jun 17, 2026
Malicious code in cryptodao-config (npm)
1 compromised version
- Jun 17, 2026
Malicious code in cryptodao-types (npm)
1 compromised version
- Jun 17, 2026
Malicious code in cryptodao-backend (npm)
1 compromised version
- Jun 17, 2026
Malicious code in cryptodao-sdk (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/posthog (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/posthog
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/clickhouse (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/clickhouse
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/inngest (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/inngest
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/braintrust (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/braintrust
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/rag (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/mongodb (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/fastify (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/fastify
1 compromised version
- Jun 17, 2026
Malware in @mastra/mongodb
1 compromised version
- Jun 17, 2026
Malware in @mastra/rag
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/mcp-docs-server (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/mcp-docs-server
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/langsmith (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/langsmith
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/sentry (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/s3 (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/fastembed (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/sentry
1 compromised version
- Jun 17, 2026
Malware in @mastra/fastembed
1 compromised version
- Jun 17, 2026
Malware in @mastra/s3
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/auth (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/auth
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/hono (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/datadog (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/datadog
1 compromised version
- Jun 17, 2026
Malware in @mastra/hono
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/editor (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/editor
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/otel-bridge (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/otel-bridge
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/dynamodb (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/dynamodb
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/duckdb (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/duckdb
1 compromised version
Page 102 of 5,122