We pointed five threat instruments at the 100 most-relied-upon packages less than two years old. Here is everything they found — and everything they didn’t.

How the 100 packages were chosen

A small program picks them automatically, using the download counts the two package stores publish. It takes every package first released in the last two years, sorts them by downloads, and keeps the top 50 from npm (JavaScript) and the top 50 from PyPI (Python). The program, the list and the results are all public in the index’s GitHub repository, and anyone can run it again and get the same list.

The scan itself also runs in public, on GitHub’s computers, using the same CodeDelta version anyone can download. Every result and log is saved in the repository.

Why new packages

These packages are less than two years old but are already downloaded hundreds of millions of times, often maintained by small teams. That combination — new code, wide use, little time for anyone to look at it closely — is why we chose them.

What was actually scanned

These figures are from the run of 1 October 2026. Eighty-nine of the 100 packages were scanned. The other eleven publish no source code at all, only ready-built files: nine are NVIDIA graphics libraries, the other two are pymupdf-layout and ua-parser-builtins. No scanner can read code that was never published.

All 50 npm packages were scanned — 917 files. Until this run, CodeDelta skipped the folder where most published npm packages keep their code, so the first index read nothing in 35 of them. CodeDelta 2.2.2 reads that folder when asked, and the index now does. In those 917 files CodeDelta found no connections to AI services, no passwords or keys, no code that runs at install and no downloads. The findings below all come from the Python packages.

Finding one: the AI packages are full of connections to AI services

The Python list is dominated by kits for building AI agents, and CodeDelta flagged most of their files: fastmcp 718 of 1,738 files, claude-agent-sdk 71 of 105, strands-agents 358 of 759, pydantic-ai-slim 252 of 370. pydantic-ai-slim can connect to 17 different AI providers, strands-agents to 9 and mlflow-tracing to 6.

None of this means these packages are dangerous — connecting to AI services is what they are for. But once one is in your software, your software can send data to those AI companies, and the index shows which ones before you install it.

Finding two: 18 password and key matches — all harmless

CodeDelta looks for text in the format of real passwords and keys. It found 18, in four packages, and we checked every one. All were deliberate examples: placeholder GitHub tokens in Google’s tests (google-genai, 2), a sample key header in a test (fastmcp, 1), sample key headers wrapped around the words “fakekey”, “fake” and “ABC” in AWS’s SageMaker tests (sagemaker-studio, 8), and the patterns inside prek, a security tool that searches for keys (7). This is why CodeDelta reports these by default but does not block a build unless you switch blocking on.

Finding three: almost nothing runs or downloads at install time

No package downloaded anything from other servers while building. Two packages add their own step to installation, and we read both. librt compiles code and, only when testing, builds a copy of a testing library that is already included in the package; it contacts no other server. sagemaker-studio registers an extra command whose code does nothing at all.

What these results do not tell you

The scan shows what the packages contained on the day it ran. A package can change in any later version, which is why the scan runs again on the first of every month and the changes between runs are what matter. Every flagged file is a place to look, not proof of a problem.

Run it on your own code

The scan runs again on the first of every month, and the repository keeps every result. The same checks run on your own code with CodeDelta, on your own machine, with nothing sent anywhere.