Is this package compromised?
Track malicious releases, account takeovers, typosquatting, dependency confusion, and worms.
Active issues (7d)
Incidents (90d)
Less More
Volume by ecosystem (30d)
Reported packages
| Package | Ecosystem | Status | Attack Type | ||
|---|---|---|---|---|---|
| pantheon-agents | pypi | Compromised | Malicious version | 1 | 12d ago |
| semantic-router | pypi | Compromised | Build pipeline | 1 | 73d ago |
| @cap-js/openapi | npm | Compromised | Worm | 1 | 95d ago |
| @cap-js/sqlite | npm | Compromised | Worm | 1 | 110d ago |
| @cap-js/db-service | npm | Compromised | Worm | 1 | 110d ago |
| @cap-js/postgres | npm | Compromised | Worm | 1 | 110d ago |
| @beproduct/nestjs-auth | npm | Compromised | Script abuse | 1 | 111d ago |
| guardrails-ai | pypi | Compromised | Malicious version | 1 | 111d ago |
| @opensearch-project/opensearch | npm | Compromised | Malicious version | 1 | 111d ago |
| @mistralai/mistralai-azure | npm | Compromised | Worm | 1 | 112d ago |
| @mistralai/mistralai | npm | Compromised | Worm | 1 | 112d ago |
| @mistralai/mistralai-gcp | npm | Compromised | Worm | 1 | 112d ago |
| mistralai | pypi | Compromised | Malicious version | 1 | 112d ago |
| @tanstack/react-router-devtools | npm | Compromised | Malicious version | 1 | 119d ago |
| @tanstack/arktype-adapter | npm | Compromised | Malicious version | 1 | 119d ago |
| @tanstack/router-plugin | npm | Compromised | Malicious version | 1 | 119d ago |
| @tanstack/react-router-ssr-query | npm | Compromised | Malicious version | 1 | 119d ago |
| @tanstack/eslint-plugin-router | npm | Compromised | Malicious version | 1 | 119d ago |
| @tanstack/react-start-rsc | npm | Compromised | Malicious version | 1 | 119d ago |
| @tanstack/router-ssr-query-core | npm | Compromised | Malicious version | 1 | 119d ago |
Live feed
Q2 2026 Open Source Malware Index
Research 60d ago
Miasma Returns: Leo Platform Compromise in npm
Incident 74d ago
When a vendor's breach becomes yours: lessons from the Klue incident
Incident 77d ago
easy-day-js Targets Mastra, Dependency Attacks Grow
Incident 82d ago
Atomic Arch npm Campaign Adds Malicious Dependency
Incident 88d ago
New Shai-Hulud Miasma Wave Hits Hundreds of npm Packages
Incident 95d ago
Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp
Incident 96d ago
Lazarus Group's Latest: Brandjacking Campaign on npm
Incident 96d ago
Protestware by open source maintainer to hinder agentic coding: The jqwik 1.10.0 Prompt Injection
Incident 98d ago
Red Hat Cloud Services npm Packages Hijacked
Incident 98d ago
Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages
Incident 99d ago
Laravel Lang Supply Chain Advisory
Advisory 107d ago
Hijacked npm Package Attempts to Deliver PolinRider-Linked RAT
Incident 109d ago
The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised
Incident 111d ago
Shai-Hulud is Back: Maintainer Accounts Are Still the Soft Target
Research 111d ago
Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account
Incident 112d ago
Malicious node-ipc versions published to npm in suspected maintainer account compromise
Incident 116d ago
How to Build a Software Supply Chain Security Playbook
Policy 117d ago