Loading npm security reports…
Skip to main contentMalware2026-08-17 16:54Malware2026-08-17 12:18Install Hook Abuse2026-08-17 10:45Malware2026-08-17 08:48
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 182
Updated 14 Oct 2026, 04:55 UTC. Ordered by latest scan.
agora402-payment-utils@1.0.0
Direct source inspection confirms both silent install-time data exfiltration and deliberate payment-recipient redirection. These are concrete malicious behaviors, not merely suspicious pr...
snavbox@1.0.2
OpenSSF/OSV malware advisory MAL-2025-49362 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. At CLI startup, index.js downloads three native shar...
@materialui-reactjs/admin@1.0.5
The package performs concrete, unconsented postinstall mutation of the consuming project's dependency manifest through a detached delayed process. No exfiltration was found, but the insta...
runtime-health@1.0.1
Direct inspection confirms concrete install-time persistence, remote shell capability, host reconnaissance, and internal credential/service probing. This is malicious behavior unrelated t...