Loading npm security reports…
Skip to main contentMalware2026-08-07 00:35Malware2026-08-07 00:35Malware2026-08-07 00:35Malware2026-08-07 00:35
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 229
Updated 15 Oct 2026, 06:12 UTC. Ordered by latest scan.
electrode-ota-ui-app@99.0.0
OpenSSF/OSV malware advisory MAL-2026-12368 blocks this version. Package targets the electrode-io internal name `electrode-ota-ui-app` with an inflated 99.0.1 version to win dependency re...
dbk-ui-forms@99.0.1
OpenSSF/OSV malware advisory MAL-2026-12669 blocks this version. On `npm install`, the package's preinstall hook runs index.js which collects host identity (hostname, username, homedir, n...
dbk-ui-forms@99.0.0
OpenSSF/OSV malware advisory MAL-2026-12669 blocks this version. On `npm install`, the package's preinstall hook runs index.js which collects host identity (hostname, username, homedir, n...
@cy4dev/cydemo-bg-color@6.0.0
OpenSSF/OSV malware advisory MAL-2026-12504 blocks this version. @cy4dev/cydemo-bg-color@7.0.0 ships a postinstall lifecycle script (src/postinstall.js) that runs at `npm install` time an...