Loading npm security reports…
Skip to main contentMalware2026-08-05 07:45Malware2026-08-05 07:45Malware2026-08-05 07:45Malware2026-08-05 07:45
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 289
Updated 16 Oct 2026, 14:03 UTC. Ordered by latest scan.
tailwind-anim@0.0.1
OpenSSF/OSV malware advisory MAL-2026-11500 blocks this version. index.js appends an eval(atob(...)) blob to an otherwise legitimate Tailwind plugin. On require(), the decoded loader quer...
tailwindcss-anim@0.0.1
OpenSSF/OSV malware advisory MAL-2026-11487 blocks this version. index.js hides a base64-encoded payload after a long run of tab characters and executes it via eval(atob(...)) at module l...
stargateproxyserv@24.0.0
OpenSSF/OSV malware advisory MAL-2026-11103 blocks this version. stargateproxyserv@28.0.0 declares a `preinstall` script that runs `node index.js`, which collects installer host identifie...
eth-bridge@1.0.0
OpenSSF/OSV malware advisory MAL-2026-11461 blocks this version. The package presents itself as an Ethereum bridge library but its index.js is a verbatim copy of the well-known eth-sig-ut...