OpenClaw got 591 advisories. 1 in 4 top npm installs is the real hole

Short answer: Open-source security advisories went from about 295 a month in 2025 to 1,559 a month from March to May 2026, and 2026 already has 11,198 GitHub-reviewed advisories against 3,542 in all of 2025. The AI tools are a big part of the pile: one npm package, the OpenClaw agent, collected 591 advisories this year, more than every Rust crate on crates.io combined (483). But the scary count is not where the risk sits. OpenClaw users are 96.9% on clean versions; the 40 most-downloaded npm packages with a 2026 advisory are not: 35.2% of their 5.6 billion weekly downloads installed a version with a known hole that was fixed before October 1.

TL;DR: AI bug hunters roughly tripled the open-source advisory count in 2026, and npm took the biggest hit at 5.5x its 2025 total. AI apps and agents went from 4.1% of advisories in 2024 to 15.5% in 2026. The fix is boring and takes 10 seconds: check the version you actually run, not the headline count, with npm audit, cargo audit, pip-audit or one OSV query (commands below). Checked Oct 24, 2026, 2 AM ET. Every number below is in the CSV.

Key numbers

What	Number	Source, checked Oct 24 2026
GitHub-reviewed advisories, all of 2025	3,542 (295 a month)	OSV.dev dumps of the GitHub Advisory Database, 8 ecosystems
Same, 2026 through Oct 23	11,198 (3.2x 2025 already)	same
Peak month	1,635 (May 2026), 5.5x a 2025 month	same
All CVEs published in NVD, Sep 2026	15,074 (3.6x the 2025 average of 4,164)	NVD CVE API 2.0
npm advisories, 2026 vs 2025	3,314 vs 606 (5.5x)	OSV.dev
crates.io (Rust) advisories, 2026 vs 2025	483 vs 177 (2.7x)	OSV.dev
OpenClaw (one npm package) advisories in 2026	591	OSV.dev
Share of advisories hitting AI apps, agents, LLM libraries, MCP servers	4.1% (2024), 8.8% (2025), 15.5% (2026)	our package-name classifier, list in the CSV
OpenClaw downloads last week on a version with any known advisory	3.1% (55,816 of 1,820,881)	npm per-version downloads + OSV
Top 40 npm packages with a 2026 advisory: weekly downloads on a version with a hole fixed before Oct 1	35.2% (1.97 billion of 5.58 billion)	npm per-version downloads, Oct 16 to 22, + OSV
Same, high or critical severity only	24.7% (1.38 billion)	same
Advisories whose text says an AI found or helped find the bug	4 in 2025, at least 80 in 2026 (27 in October)	our text scan of every GHSA advisory

Download the data (CSV: monthly advisory counts per ecosystem 2024 to 2026, NVD monthly CVE counts, the AI-package share by month, the top packages of 2026, and the per-package npm exposure table. Every row says what it counts and where it came from.)

Why this came up tonight

Drew Silcock's post "Is this the new cyber normal?" has been sitting on the Hacker News front page all day (156 points, 173 comments when I checked). It walks through a week that looked like the internet catching fire: PHP2Shell (two PHP remote code execution bugs that Calif, working in OpenAI's "Patch the Planet" program, and Wiz both found with frontier models), GitLab, musl, LiteLLM, Railway. Right next to it on the front page: Calif's "Today, we hacked what we'd set out to hack: the iPhone" (809 points), Aikido's http2shell RCE in Node and Python, a CVE tracker built because people wanted to see the curve, and OpenAI's post on securing its own training environment.

Drew's question is "is this the new normal?". Everyone is answering it with vibes. So I pulled the actual counts, all of them, and then asked the question that matters for your app: does any of this reach the code you actually install?

(We covered the PHP side on day one: 235 top sites can never get the PHP fix. And the LiteLLM backdoor check is still the fastest way to see if that one took your keys.)

What I pulled, and how

1. Every advisory in 8 ecosystems. OSV.dev publishes a full dump per ecosystem (all.zip): npm, PyPI, Go, crates.io, Packagist (PHP), Maven, RubyGems, NuGet. 50,537 records after dropping malware reports (MAL- ids) and withdrawn ones. To compare ecosystems fairly I count only GitHub-reviewed advisories (GHSA- ids), one reviewer for everything, by publish date.
2. Every CVE in NVD. One query per month to the NVD API, Jan 2024 to Oct 2026, reading totalResults. That is a second, independent counter.
3. Which version people actually install. npm publishes downloads per version for the last 7 days (api.npmjs.org/versions/<pkg>/last-week). For the 40 most-downloaded npm packages that got an advisory in 2026, plus a handful of AI tools, I sent every downloaded version to OSV's batch API and asked: which known advisories affect this exact version?

The harness is about 300 lines of Python, no API keys. The run took about 40 minutes, most of it waiting on npm's rate limit.

The flood: 295 a month became 1,559

Through 2024 and 2025 the GitHub Advisory Database added a steady 200 to 400 reviewed advisories a month. Then 2026 happened: 479 in January, 750 in February, 1,550 in March, 1,635 in May. It fell back to 711 in August, which looks to me like reviewers drowning rather than bugs drying up, and it is climbing again: 910 in the first 23 days of October.

NVD, which counts every CVE and not just open-source packages, tells the same story on a delay. It ran around 4,000 a month in 2025 and hit 15,074 in September 2026, 3.6x its 2025 average.

Two counters, two different review pipelines, same shape. This is not one database changing its rules. Something is producing far more bug reports than it did a year ago, and every security person I read this week names the same thing: models that can read a diff, find the bug the patch fixes, and write the exploit in an afternoon.

npm took the biggest hit: 5.5x

Split by ecosystem, nobody escaped, but the spread is wide. npm went from 606 advisories in 2025 to 3,314 in under ten months (5.5x). PyPI 3.4x, Go 3.1x, Rust 2.7x, PHP 2.5x, Java (Maven) only 1.4x.

Rust's number deserves a straight reading, because it's our home turf and the language war will start in the comments. 483 advisories is a lot more than 177. But look at what they are: Rust's own advisory database (RustSec) flagged 55 crates as unsound in 2026 and 61 as unmaintained, which is housekeeping as much as attack surface. And the one AI-found Rust bug in our scan is a good example of what changed: a yara-x advisory notes the bug "was identified during an agentic unsafe Rust code review performed by Gemini AI, followed by human review". The models go straight for the unsafe blocks. Rust gives them a much smaller target.

The AI tools are the new bug farm

Here is the part the AI labs don't put in their launch posts. I tagged every advisory whose package is an AI app, agent framework, LLM library or MCP server (OpenClaw, n8n, open-webui, Flowise, vLLM, LangChain, LiteLLM, LlamaIndex, mlflow, every mcp- server; the full name list is in the CSV). Their share of all advisories:

• 2024: 4.1% (146 of 3,527)
• 2025: 8.8% (312 of 3,542)
• 2026: 15.5% (1,734 of 11,198)

One in six advisories this year hit the stuff we use to build with AI. The tool that writes your code, the agent that reads your email, the gateway that holds your API keys. And at the top of the list, by a mile:

OpenClaw, the open-source personal agent, has 591 advisories in 2026. Every crate on crates.io together has 483. All of RubyGems has 189. n8n has 139, open-webui 136.

What OpenClaw's 591 are

I read the titles. This is not 591 typos. It is what happens when you give an agent shell access, a browser, a dozen chat integrations and an approval system, and then point other agents at it. The most common word in the titles is bypass (146): allowlist bypasses, approval bypasses, sandbox escapes, "auth" problems (91), things that run commands (72).

Severity split: 20 critical, 216 high, 301 moderate, 54 low. The first wave landed in February and March (78, then 272 in March alone), which is when the project went viral and every security team on earth pointed a model at it.

Now the twist, and it's why I don't think OpenClaw is the villain here. The project publishes everything, fixes fast, and its users update. Of OpenClaw's 1,820,881 npm downloads last week, 96.9% were versions with zero known advisories. The current release, 2026.10.6, has none. The January build, 2026.1.29, has 558. The count is the project's history. What you run is your risk.

The real hole is your lockfile

So I ran the same test on the packages everybody installs without thinking: the 40 most-downloaded npm packages that got an advisory in 2026. Glob matchers, YAML parsers, ws, axios, vite, lodash. Together: 5.58 billion downloads last week.

To be fair to everyone, I only count advisories published before October 1, so every fix had at least two weeks to land before the download window (Oct 16 to 22).

35.2% of those downloads installed a version with a known, already-fixed advisory. 24.7% (1.38 billion installs in one week) had a high or critical one.

Package	Downloads, Oct 16-22	2026 advisories	On a version with a pre-Oct fix	Same, high/critical
minimatch	459.2M	3	21.7%	21.7%
brace-expansion	400.0M	8	56.4%	56.0%
picomatch	338.9M	2	18.2%	18.2%
ajv	249.3M	1	23.7%	0.0%
zod	221.6M	1	0.2%	0.0%
postcss	199.8M	4	42.7%	40.4%
esbuild	197.0M	1	34.5%	0.0%
js-yaml	188.7M	8	54.9%	53.7%
uuid	187.3M	1	65.6%	0.0%
ws	184.3M	2	30.7%	30.7%
axios	70.2M	48	58.9%	58.9%
vite	127.2M	12	30.7%	30.7%
lodash	101.0M	3	34.8%	34.8%
next	44.6M	44	45.2%	45.2%
electron	5.3M	49	42.5%	42.5%
@anthropic-ai/claude-code	7.2M	16	6.2%	6.2%
openclaw	1.8M	591	3.0%	2.5%

Rows: the 10 most-downloaded packages in the set, plus a few you will recognise. The other 30 are in the CSV.

Before anyone panics: a lot of these are denial-of-service bugs (ReDoS, runaway memory) in build tools. A slow regex in your bundler is not an open door to your database. But not all of them. axios alone has 48 advisories in 2026, most of them prototype-pollution "gadgets" that can leak a proxy password or hijack a request, and 58.9% of axios installs last week were on a version with a high-severity one fixed before October. That pattern, the same bug class found over and over in one library, is exactly what a model running in a loop is good at.

Compare that with OpenClaw at 3.1%. The project with 591 advisories is the one whose users are current. The packages nobody thinks about are the ones quietly shipping known holes into every CI build. Vercel's own next: 45.2% of 44.6 million installs last week landed on a version with a high or critical advisory fixed before October.

Who is actually finding these

Almost nobody says. I scanned the text of every GitHub advisory for a line that credits an AI with the find. 2024: zero. 2025: 4 (all XBOW). 2026: at least 80, and 27 of them in October alone. A few, quoted straight from the advisories:

• Podman, critical: "This vulnerability was discovered by ADA Logics Ltd using Anthropic's Claude models." (GHSA-2cvf-wqm6-wr9g)
• Nuxt: "Reported by Anthropic / Claude as part of Anthropic's coordinated vulnerability disclosure programme." (GHSA-534h-c3cw-v3h9)
• NocoDB: "This issue was discovered by an AI agent developed by the GitHub Security Lab." (GHSA-rcph-x7mj-54mm)
• yara-x (Rust): "identified during an agentic unsafe Rust code review performed by Gemini AI." (GHSA-2jx3-ff3v-j7jj)

80 credited out of 11,198 is under 1%. My read: the real share is many times that, and nobody credits the model for the same reason nobody credits their linter. The labs, meanwhile, are happy to take the credit in public (OpenAI's "Patch the Planet", Anthropic's disclosure pipeline) because "our model found 500 bugs" sells the model. Both things can be true: the bugs are real, and the marketing department is very real too.

My take

The flood is not going to stop, it is going to get cheaper. Every model release this year made finding bugs easier, and finding is now cheaper than fixing. That flips the job. For a decade "keep dependencies updated" was hygiene you did when you felt like it. In 2026 it is the whole defense, because the gap between "advisory published" and "someone has a working exploit" is now measured in hours (Drew's post makes that case well, and the PHP2Shell timeline backs it up).

My bet: by the end of 2026 the GitHub database passes 14,000 reviewed advisories for the year, AI tools stay above 15% of them, and the share of top-package npm installs sitting on a known high-severity hole doesn't move, because lockfiles don't read the news. I'll rerun this exact pull on January 2 and post the numbers either way.

And yes, I'd still install OpenClaw before I'd trust a three-year-old lockfile. That's the uncomfortable part.

Check your stack in 10 seconds

Pick your ecosystem. Each command checks the versions in your lockfile against the same public advisory data I used.

# JavaScript / Node (npm, built in)
npm audit --omit=dev

# Rust
cargo install cargo-audit && cargo audit

# Python
pip install pip-audit && pip-audit

# Any language, one tool (Google's OSV-Scanner)
osv-scanner scan source -r .

Want to check one package and version without installing anything? Ask OSV directly. This is the exact query behind the OpenClaw numbers:

curl -s -d '{"package":{"name":"openclaw","ecosystem":"npm"},"version":"2026.1.29"}' \
  https://api.osv.dev/v1/query | grep -o '"id":"GHSA[^"]*"' | wc -l
# 558 known advisories on the January build. Try "2026.10.6": 0.

Swap in your package, ecosystem (npm, PyPI, crates.io, Go) and the version from your lockfile. If the number is above zero, read the advisory, then update. If you want a feel for how much a download count really tells you, our crates.io download checker shows the same "headline vs reality" gap for downloads.

What this data can't tell you

• Advisory counts measure disclosure, not danger. A project that publishes every finding (OpenClaw does) looks worse than one that quietly patches. The count is a signal of attention as much as of bad code.
• GitHub review is a bottleneck. The August dip may be reviewers falling behind, not fewer bugs. Unreviewed advisories are not in this count.
• Download counts are mostly machines. CI runs, mirrors and lockfile installs dominate npm numbers (our crates.io study found most downloads land on release days). That is the point here: those machines are installing the old versions.
• "Affected version" isn't "exploitable". A ReDoS in a dev dependency rarely matters in production. I split out high and critical, but I did not judge reachability package by package.
• The AI-package list is a name match. It catches packages whose names say what they are (openclaw, langchain, mcp-server-*) and misses AI features buried inside general tools. The full list is in the CSV; tell me what it got wrong.
• AI credit lines are self-reported. 80 is a floor, not an estimate.

If you built your app with AI

The audit commands above cover your dependencies. They don't cover the code your AI tool wrote for you: an open Supabase table, an API key shipped to the browser, a storage bucket anyone can list. That is what our $49 Launch Check tests on apps built with Lovable, Bolt, Cursor, Replit or Supabase: can a stranger read your tables, are keys exposed, are buckets open, are there rate limits, in plain English within 48 hours. Guaranteed: if a problem in what we checked turns up after your report, we review it and write the fix at no extra cost. This week's PHP2Shell and http2shell are a good reminder that "later" now means "after someone else's model found it".

More of our security and Rust work: Rust, AI industry, and yesterday's UUIDv7 library test. As featured in This Week in Rust.

So, honest question for the comments: when did you last run npm audit and actually fix what it said? And if you think the AI bug flood is mostly slop exploits that don't work, tell me which of the 11,198 you'd throw out.

Sources

• Drew Silcock, Is this the new cyber normal? (Oct 23, 2026); Hacker News thread.
• Calif, Today, we hacked what we'd set out to hack: the iPhone (Oct 16, 2026); HN thread.
• Aikido Security, http2shell; HN thread.
• OpenAI, Securing our frontier model training environment.
• 0xosprey, CVE Tracker (built on CVEProject/cvelistV5).
• OSV.dev (Google): ecosystem data dumps, query API, batch API, OSV-Scanner.
• GitHub Advisory Database; individual advisories linked above.
• NVD CVE API 2.0, NIST.
• npm download counts API (per-version downloads, last 7 days).
• RustSec advisory database; cargo-audit; pip-audit.
• OpenClaw on npm and GitHub.
• Our data: data.csv.