Loading npm security reports…
Skip to main contentMalware2026-08-05 17:20Malware2026-08-05 17:20Malware2026-08-05 17:20Malware2026-08-05 17:20
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 225
Updated 14 Oct 2026, 05:15 UTC. Ordered by latest scan.
kordyn@0.9.17
OpenSSF/OSV malware advisory MAL-2026-11139 blocks this version. kordyn@0.9.14 advertises itself in package.json and README as an unimplemented placeholder for trivial streak utilities ('...
kordyn@0.9.15
OpenSSF/OSV malware advisory MAL-2026-11139 blocks this version. kordyn@0.9.14 advertises itself in package.json and README as an unimplemented placeholder for trivial streak utilities ('...
lakk-analytics@9.9.11
OpenSSF/OSV malware advisory MAL-2026-13348 blocks this version. lakk-analytics@9.9.11 runs `node index.js` from an npm install lifecycle hook, which loads `./lib/core` and constructs a s...
javas-crypto@2.0.4
OpenSSF/OSV malware advisory MAL-2026-13347 blocks this version. javas-crypto ships a postinstall hook (package.json line 11: "postinstall": "node setup.js") and a top-level autoExecute()...