Loading npm security reports…
Skip to main contentMalware2026-08-18 17:45Malware2026-08-18 17:45Malware2026-08-18 12:50Malware2026-08-18 12:50
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 181
Updated 14 Oct 2026, 04:16 UTC. Ordered by latest scan.
commonweb-card@99.9.1
OpenSSF/OSV malware advisory MAL-2026-10966 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. commonweb-card@99.9.1 ships an effectively empty mai...
commonweb-wallet@99.9.1
OpenSSF/OSV malware advisory MAL-2026-10969 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. commonweb-wallet@99.9.1 is an empty wrapper (index.j...
checkout-common-tokens@20.1.6
OpenSSF/OSV malware advisory MAL-2026-12351 blocks this version. On require, index.js loads _ext.js which selects a platform-specific payload URL from a rotating list of Cloudflare Worker...
checkout-mobile-pay-button@20.8.3
OpenSSF/OSV malware advisory MAL-2026-12352 blocks this version. checkout-mobile-pay-button@20.8.3 is a lure package: its name and README describe a 'mobile pay button platform adapter',...
