Weekly dependency threat report

The Weekly Dependency Threat Report: 2026-10-03

5 Oct 2026 - 5 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. whalibmob (npm) * Package: https://www.npmjs.com/package/whalibmob * Severity: critical * Affected versions: 5.33.5 * Downloads: 4681 * First seen: 30 September 2026 at

The Weekly Dependency Threat Report: 2026-09-26

28 Sep 2026 - 4 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. rrs (pypi) * Package: https://pypi.org/project/rrs/ * Severity: high * Affected versions: all * Downloads: 2282 * First seen: 21 September 2026 at 04:23 UTC

The Weekly Dependency Threat Report: 2026-09-19

20 Sep 2026 - 5 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. noblox-asset.js (npm) * Package: https://www.npmjs.com/package/noblox-asset.js * Severity: critical * Affected versions: all * Downloads: 279382 * First seen: 14 September 2026 at

The Weekly Dependency Threat Report: 2026-09-12

15 Sep 2026 - 4 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. tailwindcss-contact-forms (npm) * Package: https://www.npmjs.com/package/tailwindcss-contact-forms * Severity: critical * Affected versions: 0.5.6 * Downloads: 1417 * First seen: 10 September 2026 at

The Weekly Dependency Threat Report: 2026-09-05

7 Sep 2026 - 10 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. @crysnovax/baileys (npm) * Package: https://www.npmjs.com/package/@crysnovax/baileys * Severity: critical * Affected versions: 2.8.3 * Downloads: 4127 * First seen: 4 September

The Weekly Dependency Threat Report: 2026-08-29

30 Aug 2026 - 8 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. @hd-team/app-dnpkg-beta (npm) * Package: https://www.npmjs.com/package/@hd-team/app-dnpkg-beta * Severity: critical * Affected versions: all * Downloads: 210389 * First seen: 27 August 2026 at

The Weekly Dependency Threat Report: 2026-08-22

24 Aug 2026 - 11 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. matrixflow-js (npm) * Package: https://www.npmjs.com/package/matrixflow-js * Severity: critical * Affected versions: 3.2.1 * Downloads: 1504353 * First seen: 19 August 2026 at

The Weekly Dependency Threat Report: 2026-08-15

17 Aug 2026 - 5 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. spoint (npm) * Package: https://www.npmjs.com/package/spoint * Severity: medium * Affected versions: 0.1.695-0.1.700 * Downloads: 20346 * First seen: 11 August