# 0Day

> 0Day sends zero-day and supply-chain attack alerts matched to the exact
> packages and versions a GitHub organization actually ships, pushed to
> engineers' phones, often before an official CVE is published.

0Day connects read-only to a GitHub organization's dependency graph (all
repos, every transitive dependency, SBOM-based) and pushes an alert the
moment a package and version in use is flagged as under attack. AI triages
and corroborates signals from 20+ threat intelligence sources; every signal
climbs a three-stage confidence pipeline (Candidate → Early Warning →
Confirmed) before it reaches a team. 0Day is not a scanner; it is the
real-time awareness layer that sits in front of one. It is built and
operated by Richard Lous, an independent software engineer in the
Netherlands. All user data is stored in the EU (AWS eu-west-3, Paris).

Frequently asked: Does 0Day replace a dependency scanner? No — scanners
audit on a cadence and open patch PRs, 0Day alerts the moment a shipped
package/version is flagged as under attack, often hours or days before an
advisory or CVE exists. Is 0Day for teams without a security team? Yes —
connect a GitHub org once and every engineer gets push alerts for the repos
they own, no triage queue, no dashboard babysitting. What GitHub access
does 0Day need? Read-only access to dependency manifests and the dependency
graph, never the contents of source files; uninstalling the app ends all
access immediately.

## Docs

- [Homepage](https://0dayalerts.com/): overview, how alerts work, live threat feed, waitlist signup
- [npm Supply Chain Attacks: Incident Watch](https://0dayalerts.com/npm-supply-chain-attacks): a running record of confirmed npm supply chain attacks since 2018
- [0Day vs. dependency scanners](https://0dayalerts.com/0day-vs-dependency-scanners): how 0Day differs from SCA tools and advisory feeds
- [Security & Access](https://0dayalerts.com/security): exactly what the GitHub App can and cannot see, data flow, revocation

## Incident Watch (chronological)

- [eslint-scope npm Account Hijack](https://0dayalerts.com/eslint-scope-npm-account-hijack): July 2018
- [event-stream npm Bitcoin Wallet Attack](https://0dayalerts.com/event-stream-npm-bitcoin-wallet-attack): September–November 2018
- [ua-parser-js npm Package Compromised](https://0dayalerts.com/ua-parser-js-npm-package-compromised): October 2021
- [coa and rc npm Packages Compromised](https://0dayalerts.com/coa-rc-npm-packages-compromised): November 2021
- [Nx "s1ngularity" npm Attack](https://0dayalerts.com/nx-s1ngularity-npm-attack): August 2025
- [Shai-Hulud npm Worm](https://0dayalerts.com/shai-hulud-npm-worm-attack): September 2025
- [Axios npm Package Compromise](https://0dayalerts.com/axios-npm-package-compromised): March 2026
- [node-ipc npm Package Compromised](https://0dayalerts.com/node-ipc-npm-package-compromised): May 2026
- [Miasma: Red Hat npm Worm Attack](https://0dayalerts.com/miasma-redhat-npm-worm-attack): June 2026
- [Mastra AI npm Supply Chain Attack](https://0dayalerts.com/mastra-ai-npm-supply-chain-attack): June 2026

## Legal

- [Privacy policy](https://0dayalerts.com/privacy): GDPR-compliant, EU data residency, no tracking
- [Terms of use](https://0dayalerts.com/terms): terms governing use of the iOS app and subscriptions

## Optional

- [iOS app](https://apps.apple.com/us/app/0day-cve-exploit-alerts/id6761655372): stack-based CVE & exploit alerts for individual engineers, rated 5.0, live today
- Contact: support@0dayalerts.com