Loading npm security reports…
Skip to main contentMalware2026-08-07 00:35Malware2026-08-07 00:35Malware2026-08-07 00:35Malware2026-08-07 00:35
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 231
Updated 15 Oct 2026, 07:06 UTC. Ordered by latest scan.
vanexa-agent@1.1.24
OpenSSF/OSV malware advisory MAL-2026-10751 blocks this version. When the user runs `vanexa-agent start`, the daemon opens a persistent WebSocket to a hardcoded Cloudflare Workers relay a...
uzair-rajput-new@1.2.0
OpenSSF/OSV malware advisory MAL-2026-13360 blocks this version. The package is published as a chalk/tinygradient color-gradient wrapper, and its ESM entrypoint dist/index.js matches that...
zyr-agent@1.6.2
OpenSSF/OSV malware advisory MAL-2026-13471 blocks this version. zyr-agent ships an AI coding agent whose default 'free' provider routes chat completions to a hardcoded preview-slug endpo...
zyr-agent@1.5.7
OpenSSF/OSV malware advisory MAL-2026-13471 blocks this version. zyr-agent ships an AI coding agent whose default 'free' provider routes chat completions to a hardcoded preview-slug endpo...