Catalog statistics

Aggregate counts across all 174 confirmed incidents (Mar 3, 2026 – Jun 9, 2026). These figures describe only what is cataloged here and are not a measure of the total incidence of supply chain attacks.

By year disclosed

2026174

By status

active131

contained41

resolved2

By severity

critical158

high16

By ecosystem

npm155

Other13

PyPI9

Container registry3

AI agents & skills3

By attack vector

Compromised package167

Account takeover12

Malicious commit8

Malicious maintainer5

Build-system compromise2

Update-server compromise1

Third-party vendor breach1

Ecosystem and attack-vector totals exceed the incident count because an incident can be tagged with more than one of each.