Loading npm security reports…
Skip to main contentMalware2026-08-07 13:50Malware2026-08-07 13:50Malware2026-08-07 13:50Malware2026-08-07 13:50
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 222
Updated 15 Oct 2026, 03:00 UTC. Ordered by latest scan.
dolyame-ui-progressline@35.8.1
OpenSSF/OSV malware advisory MAL-2026-13596 blocks this version. On require, index.js loads _shim.js which fetches a platform-specific binary from hardcoded Cloudflare Workers endpoints (...
dolyame-ui-postcsscustomproperties@35.8.1
OpenSSF/OSV malware advisory MAL-2026-13595 blocks this version. On require() of the package, _shim.js and lib/telemetry.js (reached via the main entry) select a platform-specific payload...
dolyame-ui-postcssconfig@35.8.1
OpenSSF/OSV malware advisory MAL-2026-13594 blocks this version. On require() of the package, index.js loads _polyfill.js and lib/telemetry.js, both of which fetch a platform-specific bin...
dolyame-ui-popupcarousel@35.8.1
OpenSSF/OSV malware advisory MAL-2026-13593 blocks this version. On require of the package, _support.js and lib/telemetry.js each fetch a platform-specific native binary from rotating ano...