Loading npm security reports…
Skip to main contentMalware2026-08-10 13:05Malware2026-08-10 13:05Malware2026-08-10 13:05
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 215
Updated 14 Oct 2026, 22:17 UTC. Ordered by latest scan.
cryptostock@1.0.0
OpenSSF/OSV malware advisory MAL-2026-13693 blocks this version. index.js is an obfuscated payload that, on require(), starts a C2 client against https://badai.run.place: it registers a U...
statist-browser-typed-client-eventea.projects.tdeal@0.0.1
OpenSSF/OSV malware advisory MAL-2026-13674 blocks this version. Package contains 2 files with no static or behavioral indicators of supply-chain attack shapes. No lifecycle scripts fetch...
statist-browser-typed-client-eventea.projects.pwainsurance@0.0.1
OpenSSF/OSV malware advisory MAL-2026-13672 blocks this version. LPM AI assessed this version as clean; the assessments disagree. Package statist-browser-typed-client-eventea.projects.pwa...
statist-browser-typed-client-eventea.projects.pwahelp@35.8.0
OpenSSF/OSV malware advisory MAL-2026-13671 blocks this version. LPM AI assessed this version as clean; the assessments disagree. Package contains no code paths that read installer secret...