Are you still shipping a compromised package?
Named npm, PyPI, and Cargo attacks where a specific package version was confirmed malicious. CodeTrawl matches a repo’s actual dependency tree against this curated list — so “are we affected?” gets a dated, cited answer instead of a shrug.
Maintainer's npm token was phished; malicious versions executed an install.js that dropped a node-gyp.dll malware payload on Windows installs.
Compromised maintainer token led to two malicious releases that exfiltrate Solana private keys at runtime.
Maintainer's npm credentials compromised; attackers published versions injecting a Web3 wallet-drainer into thousands of downstream sites.
Attacker took over the abandoned 'ctx' package on PyPI and published versions that exfiltrate environment variables (AWS keys, tokens) on import.
Typosquat of the legitimate 'rust_decimal' crate. Published to crates.io with a malicious binary payload that downloads + executes second-stage code.
Maintainer Brandon Nozaki Miller shipped versions that overwrite filesystem contents with heart emoji on machines geolocating to Russia or Belarus.
Marak Squires intentionally pushed broken releases that print zalgo text and infinite-loop, breaking thousands of downstream builds.
Maintainer's npm token was compromised; attacker published malicious versions that ran a credential-stealing payload during install.
Maintainer's npm credentials were compromised; published versions installed a crypto-miner plus a password-stealing payload on Windows hosts.
A new maintainer added 'flatmap-stream' as a nested dependency; it shipped a backdoor that exfiltrated Bitcoin wallet credentials from the Copay app.
Curated from public advisories and post-mortems. Matching is manifest-scoped — it flags a compromised name@versionthat a repo still declares; it can’t see packages that entered off-manifest.