Loading npm security reports…
Skip to main contentMalware2026-10-01 03:35Malware2026-10-01 03:35Malware2026-10-01 03:35Malware2026-10-01 03:35
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 13
Updated 8 Oct 2026, 16:45 UTC. Ordered by latest scan.
mms-ref-client@0.0.1-security
OpenSSF Malicious Packages via OSV confirms mms-ref-client@0.0.1-security as malicious (MAL-2025-49227): Malicious code in mms-ref-client (npm)
jira-lint@0.0.1-security
OpenSSF Malicious Packages via OSV confirms jira-lint@0.0.1-security as malicious (MAL-2025-49226): Malicious code in jira-lint (npm)
greet-test@0.0.1-security
OpenSSF Malicious Packages via OSV confirms greet-test@0.0.1-security as malicious (MAL-2025-49225): Malicious code in greet-test (npm)
generator-epic-react@0.0.1-security
OpenSSF Malicious Packages via OSV confirms generator-epic-react@0.0.1-security as malicious (MAL-2025-49224): Malicious code in generator-epic-react (npm)