Loading npm security reports…
Skip to main contentMalware2026-08-15 09:41Malware2026-08-15 09:38Malware2026-08-15 09:38Malware2026-08-14 23:00
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 191
Updated 14 Oct 2026, 09:46 UTC. Ordered by latest scan.
dakumangalsingh@2.0.1
This is a concrete, automatically triggered remote-access payload with host fingerprinting and screenshot exfiltration. It is malicious, not an inert bundled artifact.
biklitool@1.1.20
The package performs concrete privileged, stealthy remote-access provisioning automatically at postinstall. The absence of web exfiltration does not mitigate this local backdoor behavior.
sbironman@1.0.0
Source directly confirms unconsented install-time creation of a concealed, privileged RDP access path and service masquerading. Absence of JavaScript network exfiltration does not mitigat...
@velliajs/discord@1.0.7
OpenSSF/OSV malware advisory MAL-2026-14051 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package presents itself as a discord.js clone (`...
