Is this package compromised?
Track malicious releases, account takeovers, typosquatting, dependency confusion, and worms.
Active issues (7d)
Incidents (90d)
Less More
Volume by ecosystem (30d)
Reported packages
| Package | Ecosystem | Status | Attack Type | ||
|---|---|---|---|---|---|
| com.rabbitmq:amqp-client | maven | Compromised | Other | 1 | 11d ago |
| pantheon-agents | pypi | Compromised | Malicious version | 1 | 53d ago |
| semantic-router | pypi | Compromised | Build pipeline | 1 | 114d ago |
| @cap-js/openapi | npm | Compromised | Worm | 1 | 136d ago |
| @cap-js/db-service | npm | Compromised | Worm | 1 | 151d ago |
| @cap-js/sqlite | npm | Compromised | Worm | 1 | 151d ago |
| @cap-js/postgres | npm | Compromised | Worm | 1 | 151d ago |
| @beproduct/nestjs-auth | npm | Compromised | Script abuse | 1 | 152d ago |
| guardrails-ai | pypi | Compromised | Malicious version | 1 | 152d ago |
| @opensearch-project/opensearch | npm | Compromised | Malicious version | 1 | 152d ago |
| @mistralai/mistralai-azure | npm | Compromised | Worm | 1 | 153d ago |
| @mistralai/mistralai | npm | Compromised | Worm | 1 | 153d ago |
| @mistralai/mistralai-gcp | npm | Compromised | Worm | 1 | 153d ago |
| mistralai | pypi | Compromised | Malicious version | 1 | 153d ago |
| @tanstack/react-router-devtools | npm | Compromised | Malicious version | 1 | 160d ago |
| @tanstack/arktype-adapter | npm | Compromised | Malicious version | 1 | 160d ago |
| @tanstack/router-plugin | npm | Compromised | Malicious version | 1 | 160d ago |
| @tanstack/react-router-ssr-query | npm | Compromised | Malicious version | 1 | 160d ago |
| @tanstack/eslint-plugin-router | npm | Compromised | Malicious version | 1 | 160d ago |
| @tanstack/react-start-rsc | npm | Compromised | Malicious version | 1 | 160d ago |
Live feed
Hijacked TensorLake npm Turned Install Into Credential Risk
Incident 10d ago
Q3 2026 Open Source Malware Index: When Compromise Compounds
Research 10d ago
Agents Pick Dependencies, DoWI 8430.01 Holds You Accountable
Policy 17d ago
The New Engineering Problem: Managing What AI Decides to Import
Research 24d ago
Why Are OSS Attackers Always After CI/CD Credentials?
Research 30d ago
The CRA Reporting Deadline Is Almost Here
Policy 45d ago
Hugging Face Security Incident: A New Class of Threat Is Here
Incident 47d ago
Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks
Incident 75d ago
Disrupting supply chain attacks on npm and GitHub Actions
Advisory 82d ago
The Generator Can't Be the Validator: What OpenAI's Hugging Face Incident Proves About AI Security
Incident 83d ago
Q2 2026 Open Source Malware Index
Research 101d ago
Miasma Returns: Leo Platform Compromise in npm
Incident 115d ago
When a vendor's breach becomes yours: lessons from the Klue incident
Incident 117d ago
easy-day-js Targets Mastra, Dependency Attacks Grow
Incident 123d ago
Atomic Arch npm Campaign Adds Malicious Dependency
Incident 129d ago
New Shai-Hulud Miasma Wave Hits Hundreds of npm Packages
Incident 136d ago
Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp
Incident 137d ago
Lazarus Group's Latest: Brandjacking Campaign on npm
Incident 137d ago