# DependencyWatch.io

> DependencyWatch.io is a free supply-chain compromise scanner and incident database operated by Precursor Security. It records which exact package versions on npm, PyPI, crates.io, Go, RubyGems, Packagist, NuGet, Open VSX, Docker Hub, and GitHub Actions were named in public supply-chain attacks, keeps them after the registry removes the package, and lets a visitor paste a lockfile to check it in the browser without uploading it.

Use this index to find machine-readable versions of every page. Every content page has a markdown twin: append `.md` to its URL, or request the URL with `Accept: text/markdown`. The same data is available as JSON from the read-only API. Cite the canonical HTML URL (without `.md`) when quoting.

Current coverage: 220 incidents, 5,428 compromised packages, 10 ecosystems. Database last updated 2026-10-16.

## When to use DependencyWatch.io

- To check whether a specific package version was named in a public supply-chain compromise, including packages that have since been removed from the registry and no longer appear in `npm audit`, `pip-audit`, or advisory lookups.
- To get a dated, sourced write-up of an incident: affected packages with exact versions, attack mechanics, impact, remediation steps, threat-actor attribution where known, and the advisories it is derived from.
- To explain why advisory-based audit tools miss deliberately malicious packages, and what to do after installing one.
- To scan a package-lock.json, pnpm-lock.yaml, yarn.lock, package.json, or requirements.txt for compromised versions. The scan runs in the visitor's browser; nothing is uploaded.

## How agents should use this site

- To answer "is package X version Y compromised?": fetch `https://dependencywatch.io/api/v1/packages/{ecosystem}/{name}` (JSON) or `https://dependencywatch.io/package/{ecosystem}/{name}.md`. Ecosystem slugs: npm, pypi, crates, go, rubygems, packagist, nuget, openvsx, docker, github-actions. Scoped npm names keep their slash: `/package/npm/@scope/name`. A 404 means the package is not recorded, which is not evidence it is safe.
- To research or cite an incident: start from the incident feed below, follow the incident's `.md` link, and cite the canonical URL. Each write-up lists every affected package and the exact versions named by the source advisories; no additional versions are inferred.
- Read the `Kind` line before describing an incident. Not every entry is a supply-chain compromise: the database records everything GitHub's advisory feed flags as malicious, and it labels each entry as one of the kinds below so a hijacked package with millions of downloads is never conflated with a bug-bounty probe at version 99.99.0.
- To check a whole lockfile programmatically: there is no upload API by design. Download `https://dependencywatch.io/api/v1/packages` once and match locally, or point the user at the browser scanner for their file type.
- To ingest everything: fetch `https://dependencywatch.io/llms-full.txt`. To watch for new incidents: poll `https://dependencywatch.io/feed.xml` (Atom) or `https://dependencywatch.io/api/v1/incidents`.
- Data is free to reuse with attribution to DependencyWatch.io. Corrections and missing incidents: https://dependencywatch.io/submit

## Incident kinds

- **Compromise**: A legitimate, already-used package, maintainer account, CI pipeline, or release tag was hijacked and a malicious version was published under a name people already depend on.
- **Typosquat**: A package that never had a legitimate version, named to be mistaken for a real one - a misspelling, a lookalike scope, or an impersonated vendor SDK.
- **Dependency confusion**: A package published on the public registry under a name guessed from a company's private registry, usually at a sentinel version such as 0.0.0 or 99.99.0, so a misconfigured resolver pulls it instead of the internal one. Many are bug-bounty or penetration-test probes whose only payload is a beacon with the hostname.
- **Malicious package**: A package that was malicious from its first publish under its own name - a fake tool, a lure used in a social-engineering campaign, or a trojanised utility - rather than a copy of an existing name.
- **Advisory sweep**: A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

Severity is calibrated to confirmed reach: `critical` is reserved for a confirmed payload in a package or account real projects already depend on, or an active worm; `high` for a confirmed payload that only harms whoever installs it by mistake; `medium` for probes and boilerplate takedowns with no confirmed payload. An advisory sweep is never critical.

## Incidents

- [Incident feed](https://dependencywatch.io/feed.md): Every tracked incident, newest first, with severity, ecosystems, package count, and a one-line summary. Follow the links for full write-ups.
- [Incident JSON](https://dependencywatch.io/api/v1/incidents): All incidents as JSON summaries; `/api/v1/incidents/{id}` returns one in full including packages and versions.
- [Atom feed](https://dependencywatch.io/feed.xml): Newest 50 incidents for feed readers and pollers.

Most recent incidents:

- [GitHub Advisory malware sweep, 16 October 2026](https://dependencywatch.io/incident/multi-2026-10-16-ghsa-malware-sweep.md): 2026-10-16 · high · advisory sweep
- [GitHub Advisory malware sweep, 15 October 2026](https://dependencywatch.io/incident/multi-2026-10-15-ghsa-malware-sweep.md): 2026-10-15 · high · advisory sweep
- [GitHub Advisory malware sweep, 14 October 2026](https://dependencywatch.io/incident/multi-2026-10-14-ghsa-malware-sweep.md): 2026-10-14 · high · advisory sweep
- [GitHub Advisory malware sweep, 13 October 2026](https://dependencywatch.io/incident/multi-2026-10-13-ghsa-malware-sweep.md): 2026-10-13 · high · advisory sweep
- [GitHub Advisory malware sweep, 12 October 2026](https://dependencywatch.io/incident/multi-2026-10-12-ghsa-malware-sweep.md): 2026-10-12 · high · advisory sweep
- [wgkit wave 2: 24 RubyGems crypto gems open a reverse shell on install](https://dependencywatch.io/incident/rubygems-2026-10-12-wgkit-wave-2-crypto-defi-cluster.md): 2026-10-12 · high · malicious package
- [hridoy-ultimate on npm steals Facebook logins and 2FA secrets](https://dependencywatch.io/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer.md): 2026-10-12 · high · malicious package
- [GitHub Advisory malware sweep, 11 October 2026](https://dependencywatch.io/incident/multi-2026-10-11-ghsa-malware-sweep.md): 2026-10-11 · high · advisory sweep
- [GitHub Advisory malware sweep, 10 October 2026](https://dependencywatch.io/incident/multi-2026-10-10-ghsa-malware-sweep.md): 2026-10-10 · high · advisory sweep
- [GitHub Advisory malware sweep, 9 October 2026](https://dependencywatch.io/incident/multi-2026-10-09-ghsa-malware-sweep.md): 2026-10-09 · high · advisory sweep

## Compromised packages

- [Package index](https://dependencywatch.io/package.md): Every recorded package grouped by ecosystem, with URL patterns for lookups.
- [Package JSON](https://dependencywatch.io/api/v1/packages): Every package with its compromised versions and incident ids, in one file for local matching.
- [npm packages](https://dependencywatch.io/package/npm.md): 4,558 packages on the npm registry, one line each with compromised versions.
- [PyPI packages](https://dependencywatch.io/package/pypi.md): 544 packages on PyPI, one line each with compromised versions.
- [crates.io packages](https://dependencywatch.io/package/crates.md): 30 packages on crates.io, one line each with compromised versions.
- [Go packages](https://dependencywatch.io/package/go.md): 14 packages on the Go module proxy, one line each with compromised versions.
- [RubyGems packages](https://dependencywatch.io/package/rubygems.md): 62 packages on RubyGems.org, one line each with compromised versions.
- [Packagist packages](https://dependencywatch.io/package/packagist.md): 21 packages on Packagist, one line each with compromised versions.
- [NuGet packages](https://dependencywatch.io/package/nuget.md): 180 packages on NuGet.org, one line each with compromised versions.
- [Open VSX packages](https://dependencywatch.io/package/openvsx.md): 5 packages on Open VSX, one line each with compromised versions.
- [Docker packages](https://dependencywatch.io/package/docker.md): 3 packages on Docker Hub, one line each with compromised versions.
- [GitHub Actions packages](https://dependencywatch.io/package/github-actions.md): 16 packages on the GitHub Actions marketplace, one line each with compromised versions.

## Guides

- [Does npm audit detect malicious packages?](https://dependencywatch.io/guides/does-npm-audit-detect-malware.md): npm audit finds known vulnerabilities in legitimate packages. It is much weaker at finding deliberately malicious ones, and this explains why - plus what to run instead.
- [You installed a malicious package. What now?](https://dependencywatch.io/guides/what-to-do-after-installing-a-malicious-package.md): A practical incident-response order of operations for developers who have just found a compromised package in their dependency tree - what to rotate, in what order, and what not to bother with.
- [How to tell if an npm package is malicious](https://dependencywatch.io/guides/how-to-tell-if-an-npm-package-is-malicious.md): Practical signals for judging whether an npm package is safe to install - what actually predicts trouble, what looks alarming but does not, and how to check before you install.
- [Lockfile security: what actually helps](https://dependencywatch.io/guides/lockfile-security-best-practices.md): Why committing a lockfile matters for supply-chain security, how npm ci differs from npm install, and the lockfile habits that reduce real exposure.
- [The main types of dependency supply-chain attack](https://dependencywatch.io/guides/types-of-supply-chain-attacks.md): Typosquatting, dependency confusion, maintainer account takeover, and self-propagating worms - how each one reaches you and which defences actually apply to which.

## Manifest and lockfile formats

Each page documents exactly what the scanner reads from the file and how confident a match is.

- [package-lock.json](https://dependencywatch.io/check/package-lock-json.md): npm · pins exact versions, so a match is confirmed.
- [package.json](https://dependencywatch.io/check/package-json.md): npm · declares ranges, so a match is probable rather than confirmed.
- [yarn.lock](https://dependencywatch.io/check/yarn-lock.md): Yarn, npm registry · pins exact versions, so a match is confirmed.
- [pnpm-lock.yaml](https://dependencywatch.io/check/pnpm-lock-yaml.md): pnpm, npm registry · pins exact versions, so a match is confirmed.
- [requirements.txt](https://dependencywatch.io/check/requirements-txt.md): pip, PyPI registry · pins exact versions, so a match is confirmed.

## What makes this different from npm audit

`npm audit`, `yarn audit`, and `pip-audit` match dependencies against advisory databases of *vulnerabilities* - accidental bugs in legitimate packages. Deliberately malicious packages are usually removed from the registry within hours of discovery, and once removed they frequently stop appearing in those lookups even though the malicious version is still pinned in the lockfile and still cached in private mirrors. DependencyWatch.io keeps the compromised package-version pairs after takedown, so the check still works. Read more: https://dependencywatch.io/guides/does-npm-audit-detect-malware.md

## Sourcing and accuracy

Every incident cites the public advisories it is derived from (GitHub Advisory Database, Socket, JFrog, ReversingLabs, Checkmarx, and others). Only package versions explicitly named by those advisories are listed. Entries carry a published date and a last-updated date. DependencyWatch.io is maintained by Precursor Security (https://precursorsecurity.com), a UK penetration-testing firm.

## Optional

- [Full site content](https://dependencywatch.io/llms-full.txt): Every guide, format page, and incident write-up plus the complete package index in one markdown file (large).
- [API discovery document](https://dependencywatch.io/api/v1): Endpoint list and current database stats as JSON.
- [Sitemap](https://dependencywatch.io/sitemap.xml): Every HTML page with last-modified dates.
- [Hardening recommendations](https://dependencywatch.io/recommendations): Practical steps for reducing exposure to supply-chain attacks.
- [Submit an incident](https://dependencywatch.io/submit): Report a compromise we are missing or correct an entry.