Threat Library / APT, Nation-State & Critical Infra
high
Malicious & Typosquatted Packages
Malicious libraries published to npm, PyPI and similar registries under names close to popular packages, or slipped into an existing package through a hijacked maintainer account — stealing credentials at install time, before any code runs in production.