Loading npm security reports…
Skip to main contentMalware2026-08-07 00:00Malware2026-08-07 00:00Malware2026-08-07 00:00Malware2026-08-07 00:00
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 232
Updated 15 Oct 2026, 07:33 UTC. Ordered by latest scan.
aitable-workflow-server@9.9.9
OpenSSF/OSV malware advisory MAL-2026-13437 blocks this version. The package's dist/index.js contains code combining OS command execution (ping) with outbound HTTP POST requests, a patter...
@junyoung-kim/reins@0.1.7
OpenSSF/OSV malware advisory MAL-2026-13432 blocks this version. The `reins` CLI spawns a local pseudo-terminal via node-pty (default `/bin/bash` or `cmd.exe`) and bridges it bidirectiona...
@avi892nash/aegis-grid-runner@0.3.3
OpenSSF/OSV malware advisory MAL-2026-13429 blocks this version. The package's default `bin` action starts an HTTP server (grid.mjs) that listens on GRID_RUNNER_PORT (default 7719). Incom...
@junyoung-kim/reins@0.1.6
OpenSSF/OSV malware advisory MAL-2026-13432 blocks this version. The `reins` CLI spawns a local pseudo-terminal via node-pty (default `/bin/bash` or `cmd.exe`) and bridges it bidirectiona...