Loading npm security reports…
Skip to main contentMalware2026-08-13 23:45Malware2026-08-13 23:45Malware2026-08-13 23:45Malware2026-08-13 23:45
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 201
Updated 14 Oct 2026, 14:57 UTC. Ordered by latest scan.
ac_semantic-ui_ts@99.99.100
OpenSSF/OSV malware advisory MAL-2026-5435 blocks this version. package.json declares a postinstall hook that runs canary.js, which issues an HTTP GET to bare IP 157.230.17.236 on port 80...
ac_calendar_ts@99.99.100
OpenSSF/OSV malware advisory MAL-2026-5434 blocks this version. On `npm install`, the package's `canary.js` postinstall script issues an HTTP GET to http://157.230.17.236/dc carrying the...
@demica/core@99.99.100
OpenSSF/OSV malware advisory MAL-2026-5349 blocks this version. Dep-confusion squat of internal @demica/core at sentinel high version 99.99.100 + auto-exec postinstall (canary.js) beaconi...
@demica/core@99.99.99
OpenSSF/OSV malware advisory MAL-2026-5349 blocks this version. Dep-confusion squat of internal @demica/core at sentinel high version 99.99.100 + auto-exec postinstall (canary.js) beaconi...