Loading npm security reports…
Skip to main contentMalware2026-08-27 14:35Malware2026-08-27 11:00Malware2026-08-27 11:00Malware2026-08-27 11:00
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 149
Updated 12 Oct 2026, 09:29 UTC. Ordered by latest scan.
@xayz/baileys@6.0.1
This is a concrete, non-essential account mutation that promotes the package owner's channel by default. The harmless version check and optional native loader do not mitigate that behavior.
isite@2026.8.26
OpenSSF/OSV malware advisory MAL-2026-10735 blocks this version. On initialization of the framework (index.js -> init()), lib/wsClient.js opens a WebSocket to ws://socket.social-browser.c...
isite@2026.7.1
OpenSSF/OSV malware advisory MAL-2026-10735 blocks this version. On initialization of the framework (index.js -> init()), lib/wsClient.js opens a WebSocket to ws://socket.social-browser.c...
isite@2026.6.1
OpenSSF/OSV malware advisory MAL-2026-10735 blocks this version. On initialization of the framework (index.js -> init()), lib/wsClient.js opens a WebSocket to ws://socket.social-browser.c...