Your vantage point on a hostile agent supply chain.
Aephix Vantage scans packages, skills, MCP servers, models, and agent configs across every registry, then surfaces the dangerous ones with the evidence behind each finding.
ClawHub MCP Hugging Face Open VSX VS Code JetBrains Smithery npm PyPI A2A Glama Codex plugins Claude plugins Gemini extensions Copilot plugins WiseModel ModelScope crates.io RubyGems Go NuGet Packagist PowerShell Gallery WordPress Ollama Grok Build
239,964 Malicious artifacts tracked
8 Ecosystems affected
6,592 Indicators collected
Malicious artifacts published per year
2025 saw 15× the malicious artifacts of the year before.
- npm
- pypi
- rubygems
- nuget
- crates
- go
- packagist
- vscode
| Year | npm | pypi | rubygems | nuget | crates | go | packagist | vscode | Total |
|---|---|---|---|---|---|---|---|---|---|
| 2021 | 5 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 5 |
| 2022 | 7,402 | 20 | 0 | 0 | 1 | 0 | 0 | 0 | 7,423 |
| 2023 | 2,291 | 6,467 | 16 | 0 | 1 | 0 | 0 | 0 | 8,775 |
| 2024 | 8,317 | 2,645 | 791 | 738 | 0 | 0 | 0 | 0 | 12,491 |
| 2025 | 191,307 | 1,246 | 129 | 22 | 1 | 8 | 0 | 2 | 192,715 |
| 2026 (to date) | 13,528 | 1,597 | 3,375 | 22 | 18 | 12 | 1 | 2 | 18,555 |
Malicious artifacts published per month in 2026
July was the heaviest month so far, with 4,762.
- npm
- pypi
- rubygems
- nuget
- crates
- go
- packagist
- vscode
| Month | npm | pypi | rubygems | nuget | crates | go | packagist | vscode | Total |
|---|---|---|---|---|---|---|---|---|---|
| January | 527 | 92 | 0 | 0 | 0 | 0 | 0 | 0 | 619 |
| February | 330 | 147 | 3 | 0 | 0 | 0 | 0 | 0 | 480 |
| March | 1,047 | 221 | 20 | 11 | 0 | 0 | 0 | 0 | 1,299 |
| April | 619 | 186 | 3 | 2 | 6 | 0 | 0 | 0 | 816 |
| May | 1,491 | 213 | 7 | 0 | 0 | 10 | 1 | 0 | 1,722 |
| June | 1,414 | 176 | 3 | 0 | 0 | 0 | 0 | 1 | 1,594 |
| July | 2,055 | 162 | 2,540 | 4 | 1 | 0 | 0 | 0 | 4,762 |
| August | 4,077 | 97 | 115 | 0 | 9 | 0 | 0 | 0 | 4,298 |
| September | 877 | 96 | 611 | 5 | 1 | 0 | 0 | 1 | 1,591 |
| October | 852 | 180 | 67 | 0 | 1 | 2 | 0 | 0 | 1,102 |
| November (so far) | 239 | 27 | 6 | 0 | 0 | 0 | 0 | 0 | 272 |
Where the malicious artifacts live
Known malicious artifacts by ecosystem. One engine, every agent surface.
npm 222,850 92.9%
PyPI 11,975 5.0%
RubyGems 4,311 1.8%
NuGet 782 0.326%
crates.io 21 0.009%
Go 20 0.008%
VS Code 4 0.002%
Packagist 1 <0.001%