Loading npm security reports…
Skip to main contentMalware5 days ago 11:49Malware5 days ago 11:49Malware5 days ago 11:48Malware6 days ago 19:05
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 10
Updated 8 Oct 2026, 14:35 UTC. Ordered by latest scan.
parxleys@1.0.0
Source proves automatic, unconsented account mutation directed by a remote channel list, with muting that suppresses notifications. This concrete attack supports blocking independently of...
parxleys@1.0.1
Source proves automatic, remotely directed account manipulation through the active socket entrypoint. The benign lifecycle and media-processing findings do not explain or neutralize this...
@rixxcodex/baileys@9.0.3
Source inspection establishes concealed, automatic account actions directed by a remote channel list. This is concrete unauthorized account manipulation, supporting a malicious verdict in...
@smwebserver/static@99.9.1
OpenSSF Malicious Packages via OSV confirms @smwebserver/static@99.9.1 as malicious (MAL-2026-17456): Malicious code in @smwebserver/static (npm)
