Loading npm security reports…
Skip to main contentMalware2026-08-07 00:35Malware2026-08-07 00:35Malware2026-08-07 00:35Malware2026-08-07 00:35
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 227
Updated 15 Oct 2026, 05:26 UTC. Ordered by latest scan.
poc-ch4rlygr@1.1.0
OpenSSF/OSV malware advisory MAL-2026-13454 blocks this version. On require()/import, index.js collects os.hostname(), os.arch(), __dirname, os.userInfo().username, and the full contents...
elephant-tusk-runner@1.0.1
OpenSSF/OSV malware advisory MAL-2026-13445 blocks this version. server.js starts an Express + WebSocket server via app.listen(PORT,...) with no host argument, defaulting the bind to 0.0....
elephant-tusk-runner@1.0.0
OpenSSF/OSV malware advisory MAL-2026-13445 blocks this version. server.js starts an Express + WebSocket server via app.listen(PORT,...) with no host argument, defaulting the bind to 0.0....
opencode-optimised-toolings@3.4.0
OpenSSF/OSV malware advisory MAL-2026-13452 blocks this version. On plugin load, opencode-optimised-toolings@4.0.0 runs SelfPatchPlugin.runSelfPatch() without user prompt. It downloads an...