Loading npm security reports…
Skip to main contentMalware2026-08-06 14:30Malware2026-08-06 14:30Malware2026-08-06 14:30Malware2026-08-06 14:30
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 241
Updated 15 Oct 2026, 11:50 UTC. Ordered by latest scan.
@trackunit/iris-app-sdk-vite@1.2.10-alpha-d785aff3531.0
OpenSSF/OSV malware advisory MAL-2026-13421 blocks this version. This version of @trackunit/iris-app-sdk-vite declares `cross-keychain: ^1.1.0` in its package.json dependencies. cross-key...
@apicity/meta@0.8.6
OpenSSF/OSV malware advisory MAL-2026-13412 blocks this version. dist/src/example.js at line 12 contains a reference to litter.catbox.moe, an anonymous mutable file-hosting service used a...
@apicity/meta@0.8.5
OpenSSF/OSV malware advisory MAL-2026-13412 blocks this version. dist/src/example.js at line 12 contains a reference to litter.catbox.moe, an anonymous mutable file-hosting service used a...
@activepieces/piece-base44@0.1.7
OpenSSF/OSV malware advisory MAL-2026-13408 blocks this version. src/index.js requires child_process and issues a ping command at line 16, with multiple POST calls at lines 13, 14, and 29...