Loading npm security reports…
Skip to main contentMalware2026-08-05 07:30Malware2026-08-05 07:30Malware2026-08-05 07:30Malware2026-08-05 07:30
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 291
Updated 16 Oct 2026, 15:10 UTC. Ordered by latest scan.
@wethenorth12/hd-key-generator@1.6.3
OpenSSF/OSV malware advisory MAL-2026-12095 blocks this version. @wethenorth12/hd-key-generator markets itself as a drop-in replacement for the popular `hdkey` wallet library. On require,...
@wethenorth12/ethers-wallet@6.13.5
OpenSSF/OSV malware advisory MAL-2026-12094 blocks this version. The package presents itself as a drop-in replacement for the ethers library (author metadata `ethers-io`, repository URL p...
@wethenorth12/ethers-signer@3.2.1
OpenSSF/OSV malware advisory MAL-2026-12093 blocks this version. On require(), index.js collects the host's hostname, username, home directory, platform, current working directory, and th...
@wethenorth12/etherjs@6.15.4
OpenSSF/OSV malware advisory MAL-2026-12092 blocks this version. @wethenorth12/etherjs@6.15.3 is a typosquat of the ethers package (package name, description, and author string 'ricmoo' a...