Loading npm security reports…
Skip to main contentDependency Confusion2026-07-31 22:57Dependency Confusion2026-07-31 16:56Dependency Confusion2026-07-30 10:35Dependency Confusion2026-07-22 22:37
npm threat feed
Malicious packages, on record.
Track recently blocked npm package versions from LPM Firewall scans and public OSV/GHSA advisories. Open any row for the affected version, evidence summary, verdict source, and current install policy.
Latest blocked packages
Cache refreshed 18 Aug 2026, 01:27 UTC. Refreshes when new reports are published.
mx-www-protobuf@1.0.0
This is confirmed unconsented install-time metadata collection and file creation in a package explicitly positioned as a dependency-confusion PoC. Absence of network exfiltration does not...
@mexc/shared-utils@2.0.0
The package has an unconsented postinstall that collects system/user data and mutates the filesystem, explicitly presented as dependency-confusion proof behavior. No exfiltration endpoint...
@finxsecdemo/utils@1.0.2
The source establishes intentional install-time execution and an external callback, not merely a static hint. Although no payload download or file modification was found, this is concrete...
megan-baileys@1.0.11
The lifecycle script silently hijacks another package's namespace, and runtime code performs undisclosed remote-controlled activity through user credentials. These are concrete malicious...