Malware Database

A malicious package is a library published to an open-source registry (npm, PyPI, etc.) that contains harmful code — a credential stealer, backdoor, or data exfiltrator — often disguised as a useful tool or typosquatting a popular package. Unlike a vulnerability, you don't patch it; you remove it and rotate any secrets it could reach.

Look it up here at /malware/{ecosystem}/{name} (for example, /malware/pypi/embiggen). If the package is flagged, the page lists the malicious versions, what the code does, and the indicators of compromise. You can also scan your whole dependency tree with O3 Security to catch malicious packages at install time and in CI.

Remove it from your project and lockfile immediately, then assume any secrets the build or runtime could reach were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound network activity or persistence. Match the published SHA-256 IOCs against your package cache and build artifacts to confirm exposure.

npm, PyPI, Go, Maven, RubyGems, crates.io (Rust), NuGet, and other ecosystems tracked in the OSV malicious-packages dataset. New advisories appear here within hours of being published.

From OSV's public MAL- advisory namespace, fed by the OpenSSF malicious-packages project — and many of the advisories you'll see credit O3 Security as the finder, from our own supply-chain research.