Loading npm security reports…
Skip to main contentMalware2026-09-01 11:40Malware2026-09-01 11:40Malware2026-09-01 11:40Malware2026-09-01 11:40
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 121
Updated 11 Oct 2026, 16:52 UTC. Ordered by latest scan.
picnic-store-design-system@9999.0.0
OpenSSF Malicious Packages via OSV confirms picnic-store-design-system@9999.0.0 as malicious (MAL-2026-7343): Malicious code in picnic-store-design-system (npm)
picnic-store-delivery-miniapp@9999.0.0
OpenSSF Malicious Packages via OSV confirms picnic-store-delivery-miniapp@9999.0.0 as malicious (MAL-2026-7342): Malicious code in picnic-store-delivery-miniapp (npm)
picnic-store-basket-miniapp@9999.0.0
OpenSSF Malicious Packages via OSV confirms picnic-store-basket-miniapp@9999.0.0 as malicious (MAL-2026-7341): Malicious code in picnic-store-basket-miniapp (npm)
picnic-store-page-platform@9999.0.0
OpenSSF Malicious Packages via OSV confirms picnic-store-page-platform@9999.0.0 as malicious (MAL-2026-7344): Malicious code in picnic-store-page-platform (npm)