Loading npm security reports…
Skip to main contentMalware2026-08-19 00:45Malware2026-08-19 00:45Malware2026-08-19 00:45Malware2026-08-19 00:45
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 172
Updated 13 Oct 2026, 23:18 UTC. Ordered by latest scan.
chalk-util@1.0.0
OpenSSF/OSV malware advisory MAL-2026-14168 blocks this version. chalk-util@1.0.0 is a typosquat of chalk whose index.js exports an empty object; the package's only functional code is scr...
chalk-es@1.0.0
OpenSSF/OSV malware advisory MAL-2026-14166 blocks this version. Package name mimics `chalk` but ships an empty library body; the only real behavior lives in `scripts/postinstall.js`. On...
chalk-lib@1.0.0
OpenSSF/OSV malware advisory MAL-2026-14167 blocks this version. chalk-lib is a typosquat of the popular chalk package with an empty library body (index.js exports {}) whose entire effect...
chalk-core@1.0.0
OpenSSF/OSV malware advisory MAL-2026-14165 blocks this version. chalk-core@1.0.0 typosquats the popular chalk package but ships no chalk functionality — index.js exports an empty object....