Loading npm security reports…
Skip to main contentMalware2026-08-05 18:30Malware2026-08-05 18:30Malware2026-08-05 18:20Malware2026-08-05 18:20
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 264
Updated 16 Oct 2026, 00:48 UTC. Ordered by latest scan.
streak-calc-metrics@1.0.0
The benign JavaScript math functions are a cover for an import-time execution path that launches a bundled backdoor. No lifecycle script is needed because normal import activates the payl...
app-kst-engine@2.1.6
OpenSSF/OSV malware advisory MAL-2026-13358 blocks this version. On npm install, package.json's postinstall runs `node test.js`, which triggers three malicious paths against the installer...
bigops-telephony@35.8.4
This is concrete import-time remote payload execution, not package-aligned telemetry. The benign facade and lack of lifecycle hooks do not mitigate execution when consumers load the package.
dlab_workshop@1.0.8
OpenSSF/OSV malware advisory MAL-2026-13277 blocks this version. The package's index.js reads installer-owned secret files from the home directory (~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.ss...