Loading npm security reports…
Skip to main contentMalware2026-08-07 00:35Malware2026-08-07 00:35Malware2026-08-07 00:35Malware2026-08-07 00:35
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 228
Updated 15 Oct 2026, 05:46 UTC. Ordered by latest scan.
pilgrimage-portal-client@99.0.0
OpenSSF/OSV malware advisory MAL-2026-13453 blocks this version. On `npm install`, the package's postinstall hook runs `node ping.js`, which reads the installer's hostname via `require('o...
shadowx-fca@10.1.0
OpenSSF/OSV malware advisory MAL-2026-13457 blocks this version. The package advertises a Facebook Chat API (FCA) client. Its default-exported login() function accepts email, password, an...
supersig@1.0.5
OpenSSF/OSV malware advisory MAL-2026-13461 blocks this version. The published dist bundles (dist/supersig.cjs.js, dist/supersig.esm.js, dist/supersig.umd.js), reached via the package's m...
merchantweb-lang-cookie-reset@99.99.99
OpenSSF/OSV malware advisory MAL-2026-13449 blocks this version. package.json declares the sole dependency `packet-table-thread-stream` as a direct tarball URL to a non-npm host (`https:/...