Every package we've recorded in a supply-chain compromise
5,383 packages and 11,806 package–version pairs across 217 incidents. Every entry traces back to a public advisory cited on the incident page.
- npmnpm
4,521 packages across 165 incidents · scannable via package-lock.json
- PyPIPyPI
531 packages across 84 incidents · scannable via requirements.txt
- NuGetNuGet
180 packages across 3 incidents · reference only
- RubyGemsRubyGems
62 packages across 7 incidents · reference only
- crates.iocrates.io
30 packages across 7 incidents · reference only
- PackagistPackagist
21 packages across 6 incidents · reference only
- GitHub ActionsGitHub Actions
16 packages across 5 incidents · reference only
- GoGo
14 packages across 5 incidents · reference only
- Open VSXOpen VSX
5 packages across 3 incidents · reference only
- DockerDocker
3 packages across 3 incidents · reference only
Rather than browse, just check your lockfile - it matches your whole dependency tree against all of these at once, in your browser.