Loading npm security reports…
Skip to main contentMalware2026-08-24 17:00Malware2026-08-24 17:00Malware2026-08-24 17:00Malware2026-08-24 17:00
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 156
Updated 12 Oct 2026, 13:23 UTC. Ordered by latest scan.
auth-otp@1.0.2
OpenSSF/OSV malware advisory MAL-2026-14425 blocks this version. Package advertises itself as a zero-dependency TOTP/HOTP library, but package.json runs `node lib/core.js --setup` as a po...
auth-otp@1.0.1
OpenSSF/OSV malware advisory MAL-2026-14425 blocks this version. Package advertises itself as a zero-dependency TOTP/HOTP library, but package.json runs `node lib/core.js --setup` as a po...
auth-otp@1.0.0
OpenSSF/OSV malware advisory MAL-2026-14425 blocks this version. Package advertises itself as a zero-dependency TOTP/HOTP library, but package.json runs `node lib/core.js --setup` as a po...
@gsas/gsas-sdk@999.9.15
OpenSSF/OSV malware advisory MAL-2026-14420 blocks this version. @gsas/gsas-sdk@999.9.15 is a high-version public-registry squat targeting an internal `@gsas/gsas-sdk` name. package.json...
