Loading npm security reports…
Skip to main contentStaged Payload Carrier2026-08-27 10:33Malware2026-08-27 09:28Malware2026-08-27 04:30Malware2026-08-27 04:30
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 124
Updated 11 Oct 2026, 19:03 UTC. Ordered by latest scan.
nuvyra-marketplace-sdk@1.0.7
The package contains a concealed import-time dependency activation that is unrelated to the documented SDK and deliberately suppresses errors. Although the payload is not bundled here, th...
noxleyss@1.1.3
The package contains concrete, unconsented runtime account manipulation controlled by a remote endpoint. Its benign Node-version preinstall check does not mitigate that behavior.
baileys-mbuilder@4.7.0-lts
OpenSSF Malicious Packages via OSV confirms baileys-mbuilder@4.7.0-lts as malicious (MAL-2026-14529): Malicious code in baileys-mbuilder (npm)
parallely@10.0.4
OpenSSF Malicious Packages via OSV confirms parallely@10.0.4 as malicious (MAL-2026-11143): Malicious code in parallely (npm)