package reports

Is that package safe to install?

Known vulnerabilities, confirmed malicious packages, dependency risk and the AI models that carry them. npm, PyPI, Maven, Go, NuGet, RubyGems, Packagist and WordPress.

// recently flagged malicious

fig. 01 — live from the detection pipeline

// ai models, what changed

fig. 02 — published models whose risk moved

// longest advisory record

fig. 03 — a count, not a verdict; usually a widely used package

// how to read these reports

What does a CyberXYZ package report contain?

Every known advisory for the package with its CVSS score and vector, EPSS exploitation probability, the CyberXYZ XYZ score, affected and fixed versions, the CWE weakness, and references. Confirmed malicious packages carry the detection signals, the malicious versions and what to do. Reach sections show how many packages depend on it and which published AI models carry each advisory.

What is the XYZ score?

A 0 to 10 composite computed by CyberXYZ from three parts: the advisory's CVSS base severity, exploitation evidence (EPSS probability and whether a working exploit is published), and the package's exposure in the ecosystem. It is recomputed daily as the inputs change.

How is EPSS different from CVSS?

CVSS rates how severe a vulnerability is if it is exploited. EPSS, from FIRST, estimates the probability that it will be exploited in the next 30 days. Most CVEs sit below 1 percent, so the report also shows the percentile against every other CVE.

Where does the data come from?

Advisories are ingested continuously from the National Vulnerability Database, GitHub Security Advisories, OSV, the MITRE CVE list with CISA Vulnrichment, Microsoft MSRC and Red Hat. Malicious packages come from the OSV malicious feed, CyberXYZ analysts and CyberXYZ's own cross-signal detection pipeline. AI model dependencies are resolved from HuggingFace.

A verdict looks wrong. How do I dispute it?

Every report has a dispute form at the bottom. CyberXYZ responds within two business days, and corrections are applied to the live data, not just the page.