Loading npm security reports…
Skip to main contentMalware2026-08-25 23:16Malware2026-08-25 16:11Malware2026-08-25 15:43
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 128
Updated 11 Oct 2026, 21:48 UTC. Ordered by latest scan.
hydration-ui-cls@1.0.0
This is concrete import-time execution of a bundled malicious native payload, not a package-aligned accelerator. No lifecycle hook is needed for the payload to activate when the advertise...
@crysnovax/baileys@2.7.15
The package performs an undisclosed, automatic action on the user's authenticated WhatsApp account, concealed in an obfuscated policy module. Its install hook is not the attack vector, bu...
hydration-cls-ui@1.0.0
The import-time executable is concrete, unrelated to the package purpose, and contains explicit malware capabilities. No install hook is needed for impact because ordinary application imp...
dim-hydration-ui@1.0.0
The package executes an opaque, network-capable native binary during ordinary import and detaches it from the host process. The visible JavaScript functionality does not require that binary.