What is Global Hack Map?
Global Hack Map collects publicly reported breaches, ransomware leak-site claims, exploited vulnerabilities, malicious packages and internet outages from 14 sources (CISA's Known Exploited Vulnerabilities catalogue, NVD, CVE.org, CIRCL, FIRST EPSS, the GitHub Advisory Database, OSV, RansomLook, SEC EDGAR, IODA and others) and places them on a Mapbox globe. Each incident carries a status: Confirmed, Reported, Claimed, Precautionary or Disputed.
An "Am I affected?" page checks pasted manifests and lockfiles against OSV, a `/cve` index lists critical CVEs from the last 72 hours, and `/fix/<CVE>` serves plain-text runbooks that pre-fill a prompt for Claude Code, Codex or Cursor. A read-only MCP server and `llms.txt` expose the same data to agents. Valyu supplies news extraction, answers and DeepResearch briefs; without a Valyu key the map still runs on the public feeds.
Is Global Hack Map worth it?
Global Hack Map is the most careful of the Valyu demo apps, and also the newest: the repository was created on 2 November 2026 and had 9 stars and 12 commits when we checked. It aggregates feeds that security teams already trust, CISA KEV, NVD, the GitHub Advisory Database and OSV among them, and its main contribution is presentation and triage rather than new data.
The design takes uncertainty seriously. Every incident is labelled Confirmed, Reported, Claimed (asserted on a leak site, unverified), Precautionary or Disputed, and the README says outright that an absent result is never proof you are safe. Incidents are placed at the city named in reporting, the organisation's headquarters, or the country, and never more precisely than the sources allow. That is a statement about where the victim is, not about who attacked it: a pin is not attribution.
The engineering is more mature than the age suggests. Production requests are rate limited through Upstash Redis, and protected APIs return 503 if the limiter cannot be reached rather than running unprotected; the MCP stack check allows 10 calls a minute and 60 an hour per IP. Scheduled sweeps are authenticated with `CRON_SECRET`. There are 11 test files. Without an NVD API key the new-CVE feed is limited to 5 requests per 30 seconds and falls back to CVE.org and CIRCL.
The catch: a summary is only as good as its slowest upstream. The snapshot revalidates after 10 minutes and public feeds after 15, but the README warns that upstream delays and fallback data can make the view older or incomplete. Affected-version ranges and "exploited" flags should be checked against the CISA entry or vendor advisory before anyone patches or briefs on them, and the one-click fix links only pre-fill a prompt for a coding agent; the agent's changes still need review.
Our take: it earns a tab next to the CISA catalogue for a quick read of what is being exploited this week, with the original advisory one click away and treated as the authority.
Where it earns its place
An IT lead at a 50-person company without a security team
Find out each Monday whether anything we use is being actively exploited
Pick the products you run on the Am I affected? page and read the Patch now cards, then confirm each item against the linked CISA or vendor advisory before scheduling work. The public instance costs nothing to read.
A platform engineer maintaining several Node and Python services
Check a lockfile against known vulnerabilities and malicious packages
Paste package-lock.json or requirements.txt into the stack check, or call the MCP server's check_stack tool from a coding agent, capped at 10 calls a minute. Results come from the OSV database.
A security analyst writing a weekly briefing for executives
Separate confirmed breaches from rumours before they reach the board
Filter by status so Claimed and Disputed items are flagged as such, and quote only from the original filings and advisories the map links. A Valyu DeepResearch brief is a starting draft, billed to the deployment's key.
Before you commit
- Setup
- Node 20+ and pnpm: `pnpm install`, copy `.env.example` to `.env.local`, `pnpm dev`. The map runs on public feeds with only a Mapbox token; the first production build runs the data pipeline once, about a minute.
- Integrations
- Read-only MCP server at /api/mcp, llms.txt, /fix/<CVE> runbooks, deep links to Claude Code, Codex, Cursor, Claude and ChatGPT. valyu-js ^2.11.1 for news, answers and DeepResearch.
- Data and privacy
- Pasted manifests are checked against OSV; nothing needs uploading for the product picker. Self-hosted by default; an optional Valyu account mode bills signed-in visitors' own credits. Code MIT; fonts under the SIL Open Font License.
- Cost at scale
- Hosting on Vercel with cron jobs every six hours and a daily brief at 05:30 UTC, plus Upstash Redis, a Mapbox token and Valyu credits for the news and brief layers. No hosted plan is offered.
- Limits
- Snapshot revalidates after 10 minutes and feeds after 15, not real time. NVD allows 5 requests per 30 seconds without a key; CIRCL 20 a minute anonymously, 40 with a key.
What’s good
- Five-level status label separates confirmed breaches from leak-site claims
- Draws on 14 public sources, including CISA KEV, NVD, OSV and EPSS
- Rate limits fail closed in production
- Read-only MCP server and plain-text runbooks for agents
What’s not
- Created on 2 November 2026; no track record or releases
- Aggregated view can lag or miss upstream data
- Fix links hand a prompt to a coding agent; output still needs review
- Production deploy needs Upstash Redis and a scheduler
Best for
Security engineers and IT leads who want a quick visual read of this week's exploited vulnerabilities and breaches, with sources one click away.
Global Hack Map alternatives
Global Hack Map: common questions
- Is Global Hack Map worth it?
- Unusually honest about what it knows, and barely a day old; a good morning dashboard, not a source you cite. We rate it 3.6 out of 5.
- How much does Global Hack Map cost?
- Free under the MIT licence. Self-hosting needs a Mapbox token; the news layer and research briefs bill your Valyu credits, and production needs Upstash Redis.
- What are the downsides of Global Hack Map?
- Created on 2 November 2026; no track record or releases; aggregated view can lag or miss upstream data; fix links hand a prompt to a coding agent; output still needs review; production deploy needs Upstash Redis and a scheduler.
- Who is Global Hack Map best for?
- Security engineers and IT leads who want a quick visual read of this week's exploited vulnerabilities and breaches, with sources one click away.
- How much does Global Hack Map cost for a team or in production?
- Hosting on Vercel with cron jobs every six hours and a daily brief at 05:30 UTC, plus Upstash Redis, a Mapbox token and Valyu credits for the news and brief layers. No hosted plan is offered.
- Is Global Hack Map safe for company data?
- Pasted manifests are checked against OSV; nothing needs uploading for the product picker. Self-hosted by default; an optional Valyu account mode bills signed-in visitors' own credits. Code MIT; fonts under the SIL Open Font License.
- What are the best Global Hack Map alternatives?
- The closest alternatives we have reviewed are cvENGINE and Global Threat Map.
Answers checked Nov 3, 2026.