Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-03 15:34Malware2026-09-03 15:33Malware2026-09-03 15:31Malware2026-09-03 14:50
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 118
Updated 11 Oct 2026, 15:06 UTC. Ordered by latest scan.
wallet-watcher@1.0.2
This is a concrete automatic credential-exfiltration chain unrelated to wallet balance checking. Its install hook and runtime API both activate the scanner, so it should be blocked.
hydration-ui-pkg@1.0.0
The package’s import path launches a detached binary whose embedded commands implement backdoor, payload-execution, and credential-harvesting functionality. This is concrete malicious beh...
chunk-yr2m2mz9@1.0.1
The code implements a concealed, persistent page-locking payload with no evident legitimate package interface. Absence of installation hooks and network activity limits the impact but doe...
fieldbase-webapplication-buildtools@99.99.99
OpenSSF Malicious Packages via OSV confirms fieldbase-webapplication-buildtools@99.99.99 as malicious (MAL-2026-15847): Malicious code in fieldbase-webapplication-buildtools (npm)