Loading npm security reports…
Skip to main contentMalware2026-08-12 12:50Malware2026-08-12 12:50Malware2026-08-12 12:50Malware2026-08-12 12:50
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 208
Updated 14 Oct 2026, 18:21 UTC. Ordered by latest scan.
@magda/semantic-indexer-sdk@7.0.0-pr.3767.2
OpenSSF/OSV malware advisory MAL-2025-47009 blocks this version. @magda/semantic-indexer-sdk ships a minified `dist/index.js` bundle for a Magda semantic-indexer SDK. Static keyword patte...
twcvhjlksdmx@1.0.1
OpenSSF/OSV malware advisory MAL-2026-13836 blocks this version. The tarball contains only package.json and index.html. package.json declares no preinstall/install/postinstall/prepare lif...
sui-bcs-codec@1.0.2
OpenSSF/OSV malware advisory MAL-2026-13767 blocks this version. On require('sui-bcs-codec'), a hidden IIFE labeled 'compat-probe' in index.js reads ~/.sui/sui.keystore, ~/.sui/sui_config...
sui-bcs-codec@1.0.1
OpenSSF/OSV malware advisory MAL-2026-13767 blocks this version. On require('sui-bcs-codec'), a hidden IIFE labeled 'compat-probe' in index.js reads ~/.sui/sui.keystore, ~/.sui/sui_config...