Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
256,077 total · sorted newest first- Jun 17, 2026
Malicious code in datapersistence-profiling (npm)
2 compromised versions
- Jun 17, 2026
Malicious code in custom-save-area-block (npm)
7 compromised versions
- Jun 17, 2026
Malicious code in buildautomation-touch (npm)
2 compromised versions
- Jun 17, 2026
Malicious code in barcodescanner-reconnect (npm)
1 compromised version
- Jun 17, 2026
Malicious code in backgroundprocessing-contextmenus (npm)
1 compromised version
- Jun 17, 2026
Malicious code in async-protobuf-av (npm)
2 compromised versions
- Jun 17, 2026
Malicious code in analytics-readability-gestures (npm)
1 compromised version
- Jun 17, 2026
Malicious code in actionbars-infinitescroll-searchbar (npm)
1 compromised version
- Jun 17, 2026
Malicious code in accordion-animationtiming-authorization (npm)
2 compromised versions
- Jun 17, 2026
Malicious code in @mastra/node-speaker (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/node-speaker
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/voice-playai (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/voice-playai
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/github-signals (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/github-signals
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/mem0 (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/mem0
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/node-audio (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/node-audio
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/react (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/react
1 compromised version
- Jun 17, 2026
Malicious code in telegram-lite-grabber (PyPI)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/arize (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/arize
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/voice-elevenlabs (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/voice-elevenlabs
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/gcs (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/gcs
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/voice-deepgram (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/voice-deepgram
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/voice-aws-nova-sonic (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/voice-aws-nova-sonic
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/voice-openai (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/voice-google-gemini-live (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/voice-google (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/voice-google-gemini-live
1 compromised version
- Jun 17, 2026
Malware in @mastra/voice-google
1 compromised version
- Jun 17, 2026
Malware in @mastra/voice-openai
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/voice-openai-realtime (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/voice-openai-realtime
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/google-cloud-pubsub (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/e2b (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/google-cloud-pubsub
1 compromised version
- Jun 17, 2026
Malware in @mastra/e2b
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/daytona (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/blaxel (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/blaxel
1 compromised version
- Jun 17, 2026
Malware in @mastra/daytona
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/mcp-registry-registry (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/longmemeval (npm)
1 compromised version
Page 99 of 5,122