Loading npm security reports…
Skip to main contentMalware2026-09-01 11:40Malware2026-09-01 11:40Malware2026-09-01 11:40Malware2026-09-01 11:40Malware2026-09-01 11:40
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 125
Updated 11 Oct 2026, 19:03 UTC. Ordered by latest scan.
rewactjs@8.7.6
OpenSSF Malicious Packages via OSV confirms rewactjs@8.7.6 as malicious (MAL-2026-7391): Malicious code in rewactjs (npm)
revactjs@8.7.6
OpenSSF Malicious Packages via OSV confirms revactjs@8.7.6 as malicious (MAL-2026-7390): Malicious code in revactjs (npm)
reuactjs@8.7.6
OpenSSF Malicious Packages via OSV confirms reuactjs@8.7.6 as malicious (MAL-2026-7389): Malicious code in reuactjs (npm)
remactjs@8.7.6
OpenSSF Malicious Packages via OSV confirms remactjs@8.7.6 as malicious (MAL-2026-7384): Malicious code in remactjs (npm)
reaactjs@8.7.6
OpenSSF Malicious Packages via OSV confirms reaactjs@8.7.6 as malicious (MAL-2026-7358): Malicious code in reaactjs (npm)