Skip to content
Open-Source Registry

Incidents 5 packages

found
reviewed
build behaviour
Packages1–5 of 5VersionRiskVulnsDescriptionDownloadsWhen
litellm1.107.0criticalnonePython SDK and proxy server for calling LLM provider APIs.2026-10-21
arrayref0.3.10criticalnoneIn 2026, a hijacked arrayref release pulled in a dependency that ran malware during the build.2026-08-20
ironworm0.1.0criticalnoneIn 2026, the IronWorm npm worm spread through hijacked packages and stole developer credentials at install time.2026-05-26
time-sync0.2.4criticalnoneIn 2026, the time-sync crate posed as a clock utility and uploaded developers' .env files to a fake time service.2026-03-04
xz-utils5.6.0criticalnoneIn 2024, the xz-utils 5.6.0 release tarball shipped with a covertly injected backdoor.2024-02-24