About compromised.live

What counts as active

Not every CVE. An item makes the feed only with evidence of real attacks or malware:

• Act now: added to CISA's Known Exploited Vulnerabilities catalog in the last 14 days, a hijacked release of a real package, or a poisoned GitHub Action.
• Watch: older KEV entries, and CVEs whose EPSS exploitation score just crossed 0.5 and that map to a package.
• Bulk: packages that were malicious from day one (typosquats). Hidden from the main list but always caught by the dependency checker.

Privacy: what happens to your lockfile

• Lockfiles you paste or upload are parsed in memory and never stored or logged.
• To match versions, the package names and versions (not the file) are sent to OSV.dev, Google's open vulnerability database. Private package names in your lockfile would be part of that.
• No accounts, no cookies, no analytics or tracking scripts.
• Cloudflare, which hosts the site, keeps standard request logs. Fonts load from Google Fonts.
• Checks are rate-limited per network address to keep the service fair.

Sources and licenses

• CISA Known Exploited Vulnerabilities
• FIRST EPSS exploitation scores
• OSV, including OpenSSF Malicious Packages (Apache-2.0)
• GitHub Advisory Database (CC-BY 4.0)

Data is refreshed every 10 minutes. compromised.live is independent and not affiliated with any of these organizations.

AI summaries

Summaries marked AI are written by Claude (Anthropic) from the public advisory text only, and regenerated when a source changes. Only public advisory data is sent to the model, never anything you paste. They can be wrong, so each one links to its sources.

Who runs this

compromised.live is an independent side project, provided as is with no warranty. Use it as an extra early-warning signal alongside your own security tooling, not instead of it. The source code is public.

Found a mistake?

False positives and missing threats matter on a security tool. Please report it on GitHub; every threat page and check result also has a report link.