Loading npm security reports…
Skip to main contentMalware2026-08-05 14:00Malware2026-08-05 14:00Malware2026-08-05 14:00Malware2026-08-05 14:00
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 273
Updated 16 Oct 2026, 05:36 UTC. Ordered by latest scan.
streak-daybucket@1.0.0
OpenSSF/OSV malware advisory MAL-2026-12464 blocks this version. streak-daybucket@1.0.0 presents itself as a day-bucket / streak math utility but its index.mjs embeds a hex-encoded Window...
token-list-fetcher@1.0.1
OpenSSF/OSV malware advisory MAL-2026-12481 blocks this version. On require, index.js schedules a delayed HTTPS POST that transmits the full process.env object along with os.hostname(), o...
token-list-fetcher@1.0.0
OpenSSF/OSV malware advisory MAL-2026-12481 blocks this version. On require, index.js schedules a delayed HTTPS POST that transmits the full process.env object along with os.hostname(), o...
rpc-endpoint-rotator@1.0.0
OpenSSF/OSV malware advisory MAL-2026-12431 blocks this version. index.js schedules a top-level POST on module load to https://enjbyg3xk8l.x.pipedream.net/beacon carrying the entire proce...