Is this package compromised?
Track malicious releases, account takeovers, typosquatting, dependency confusion, and worms.
Active issues (7d)
Incidents (90d)
Less More
Volume by ecosystem (30d)
Reported packages
| Package | Ecosystem | Status | Attack Type | ||
|---|---|---|---|---|---|
| com.rabbitmq:amqp-client | maven | Compromised | Other | 1 | 3d ago |
| pantheon-agents | pypi | Compromised | Malicious version | 1 | 45d ago |
| semantic-router | pypi | Compromised | Build pipeline | 1 | 106d ago |
| @cap-js/openapi | npm | Compromised | Worm | 1 | 128d ago |
| @cap-js/db-service | npm | Compromised | Worm | 1 | 143d ago |
| @cap-js/sqlite | npm | Compromised | Worm | 1 | 143d ago |
| @cap-js/postgres | npm | Compromised | Worm | 1 | 143d ago |
| @beproduct/nestjs-auth | npm | Compromised | Script abuse | 1 | 144d ago |
| guardrails-ai | pypi | Compromised | Malicious version | 1 | 144d ago |
| @opensearch-project/opensearch | npm | Compromised | Malicious version | 1 | 145d ago |
| @mistralai/mistralai-azure | npm | Compromised | Worm | 1 | 145d ago |
| @mistralai/mistralai | npm | Compromised | Worm | 1 | 145d ago |
| @mistralai/mistralai-gcp | npm | Compromised | Worm | 1 | 145d ago |
| mistralai | pypi | Compromised | Malicious version | 1 | 145d ago |
| @tanstack/react-router-devtools | npm | Compromised | Malicious version | 1 | 152d ago |
| @tanstack/arktype-adapter | npm | Compromised | Malicious version | 1 | 152d ago |
| @tanstack/router-plugin | npm | Compromised | Malicious version | 1 | 152d ago |
| @tanstack/react-router-ssr-query | npm | Compromised | Malicious version | 1 | 152d ago |
| @tanstack/eslint-plugin-router | npm | Compromised | Malicious version | 1 | 152d ago |
| @tanstack/react-start-rsc | npm | Compromised | Malicious version | 1 | 152d ago |
Live feed
Hijacked TensorLake npm Turned Install Into Credential Risk
Incident 2d ago
Q3 2026 Open Source Malware Index: When Compromise Compounds
Research 3d ago
Agents Pick Dependencies, DoWI 8430.01 Holds You Accountable
Policy 10d ago
The New Engineering Problem: Managing What AI Decides to Import
Research 17d ago
Why Are OSS Attackers Always After CI/CD Credentials?
Research 23d ago
The CRA Reporting Deadline Is Almost Here
Policy 38d ago
Hugging Face Security Incident: A New Class of Threat Is Here
Incident 40d ago
Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks
Incident 68d ago
Disrupting supply chain attacks on npm and GitHub Actions
Advisory 74d ago
The Generator Can't Be the Validator: What OpenAI's Hugging Face Incident Proves About AI Security
Incident 75d ago
Q2 2026 Open Source Malware Index
Research 94d ago
Miasma Returns: Leo Platform Compromise in npm
Incident 107d ago
When a vendor's breach becomes yours: lessons from the Klue incident
Incident 110d ago
easy-day-js Targets Mastra, Dependency Attacks Grow
Incident 115d ago
Atomic Arch npm Campaign Adds Malicious Dependency
Incident 121d ago
New Shai-Hulud Miasma Wave Hits Hundreds of npm Packages
Incident 128d ago
Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp
Incident 129d ago
Lazarus Group's Latest: Brandjacking Campaign on npm
Incident 129d ago