Incidents 5 packages
| Packages1–5 of 5 | Version | Risk | Vulns | Description | Downloads | When |
| litellm | 1.107.0 | critical | none | Python SDK and proxy server for calling LLM provider APIs. | | 2026-10-21 |
| arrayref | 0.3.10 | critical | none | In 2026, a hijacked arrayref release pulled in a dependency that ran malware during the build. | | 2026-08-20 |
| ironworm | 0.1.0 | critical | none | In 2026, the IronWorm npm worm spread through hijacked packages and stole developer credentials at install time. | | 2026-05-26 |
| time-sync | 0.2.4 | critical | none | In 2026, the time-sync crate posed as a clock utility and uploaded developers' .env files to a fake time service. | | 2026-03-04 |
| xz-utils | 5.6.0 | critical | none | In 2024, the xz-utils 5.6.0 release tarball shipped with a covertly injected backdoor. | | 2024-02-24 |