Loading npm security reports…
Skip to main contentData Exfiltrationyesterday 08:03Data Exfiltrationyesterday 05:05Data Exfiltrationyesterday 05:03
npm threat feed
npm credential and data exfiltration reports.
Investigate credential theft and data exfiltration, including attempts to send secrets or other sensitive data to an outside recipient. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Latest security reports
Updated 8 Oct 2026, 08:48 UTC. Ordered by latest scan.
wix-ssr-thunderbolt-grid-polyfill@0.1.0
The manifest activates bundles that collect host and local service information and send data to a fixed external receiver. This is active data exfiltration, so the package is malicious.
browser-metrics-plugin.contrib@99.0.1
The postinstall hook activates an outbound beacon that transmits machine identity and project path metadata to an unrelated hard-coded endpoint. This is active, unsolicited data exfiltrat...
troubleshooting@99.0.1
The package automatically transmits host and project location metadata to an unrelated external endpoint during installation and import. This is concrete data exfiltration, so the package...
css-reading-display-polyfill@1.0.0
The registry script contains active command execution and external transmission of collected system information, behavior unrelated to the stated CSS polyfill purpose. This is concrete ma...