Loading npm security reports…
Skip to main contentMalware2026-08-05 14:00Malware2026-08-05 13:45Malware2026-08-05 13:43Staged Payload Carrier2026-08-05 13:37
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 274
Updated 16 Oct 2026, 06:17 UTC. Ordered by latest scan.
@copilot-mcp/apex@1.0.0
OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...
dolyame-boxy-independent-bnpl-navigation@35.9.3
Direct source inspection confirms import-time remote payload retrieval and execution, not merely telemetry behavior. No lifecycle hook is needed because the declared main entrypoint activ...
dolyame-boxy-independent-bnpl-origination@35.6.6
OpenSSF/OSV malware advisory MAL-2026-13323 blocks this version. On require, index.js loads _ext.js which detects platform, constructs C2 hostnames by joining split string fragments (e.g....
devplatform-s3-resources@35.5.1
This is a concrete import-time staged-payload execution chain, not ordinary telemetry. The absence of lifecycle hooks does not mitigate arbitrary code execution on package import.