# Compromised package index

> Every package version DependencyWatch.io has recorded in a supply-chain compromise: 5,383 packages across 10 ecosystems. Each package page lists the exact versions named by public advisories and the incidents that flagged them. Only advisory-named versions are listed; nothing is inferred.

Package page URL pattern: `https://dependencywatch.io/package/{ecosystem}/{name}` (append `.md` for markdown). Scoped npm names keep their slash, e.g. `/package/npm/@scope/name`. JSON: `https://dependencywatch.io/api/v1/packages/{ecosystem}/{name}`.

- [crates.io](https://dependencywatch.io/package/crates.md) - 30 packages
- [Docker](https://dependencywatch.io/package/docker.md) - 3 packages
- [GitHub Actions](https://dependencywatch.io/package/github-actions.md) - 16 packages
- [Go](https://dependencywatch.io/package/go.md) - 14 packages
- [npm](https://dependencywatch.io/package/npm.md) - 4521 packages
- [NuGet](https://dependencywatch.io/package/nuget.md) - 180 packages
- [Open VSX](https://dependencywatch.io/package/openvsx.md) - 5 packages
- [Packagist](https://dependencywatch.io/package/packagist.md) - 21 packages
- [PyPI](https://dependencywatch.io/package/pypi.md) - 531 packages
- [RubyGems](https://dependencywatch.io/package/rubygems.md) - 62 packages

---

Canonical page: https://dependencywatch.io/package
Markdown version: https://dependencywatch.io/package.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).