Loading npm security reports…
Skip to main contentMalware2026-08-05 14:45Malware2026-08-05 14:45Malware2026-08-05 14:40Malware2026-08-05 14:30
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 269
Updated 16 Oct 2026, 03:25 UTC. Ordered by latest scan.
voicemail@1.0.2
OpenSSF/OSV malware advisory MAL-2026-12496 blocks this version. package.json declares both preinstall and postinstall lifecycle scripts that invoke curl against a hardcoded webhook.site...
table-ui-new@2.7.2
OpenSSF/OSV malware advisory MAL-2026-12473 blocks this version. table-ui-new@2.7.4 ships dist/config.js, exposed via the package.json `./config` subpath export, which exports a module-le...
quorvex@0.2.0
OpenSSF/OSV malware advisory MAL-2026-12422 blocks this version. quorvex@0.2.1 ships index.mjs as the package main, containing a base64-encoded Windows PE (~355KB) in a PAYLOAD constant....
application_base@9999.0.0
OpenSSF/OSV malware advisory MAL-2026-12511 blocks this version. application_base@9999.0.0 runs callback.js from its preinstall lifecycle hook on `npm install`. The script collects os.hos...