Loading npm security reports…
Skip to main contentMalware2026-09-04 06:20Malware2026-09-04 06:20Malware2026-09-04 06:20Malware2026-09-04 06:20
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 111
Updated 11 Oct 2026, 10:58 UTC. Ordered by latest scan.
megan-baileys@1.0.3
OpenSSF Malicious Packages via OSV confirms megan-baileys@1.0.3 as malicious (MAL-2026-15919): Malicious code in megan-baileys (npm)
megan-baileys@1.0.2
OpenSSF Malicious Packages via OSV confirms megan-baileys@1.0.2 as malicious (MAL-2026-15919): Malicious code in megan-baileys (npm)
megan-baileys@1.0.1
OpenSSF Malicious Packages via OSV confirms megan-baileys@1.0.1 as malicious (MAL-2026-15919): Malicious code in megan-baileys (npm)
megan-baileys@1.0.0
OpenSSF Malicious Packages via OSV confirms megan-baileys@1.0.0 as malicious (MAL-2026-15919): Malicious code in megan-baileys (npm)
@aui.io/apollo@0.1.53
The package establishes unconsented shell persistence during postinstall and uses dynamic evaluation from a user startup file. This is concrete install-hook abuse despite the absence of a...
