Loading npm security reports…
Skip to main contentMalware2026-08-05 06:50Malware2026-08-05 06:50Malware2026-08-05 06:50Malware2026-08-05 06:50
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 296
Updated 16 Oct 2026, 18:08 UTC. Ordered by latest scan.
tailwind-motionkit@1.0.1
OpenSSF/OSV malware advisory MAL-2026-11104 blocks this version. Review of tailwind-motionkit@1.0.3 surfaced no evidence of exfiltration, install-time remote code execution, silent relay,...
sixbails@1.0.4
OpenSSF/OSV malware advisory MAL-2026-11088 blocks this version. sixbails is a WhatsApp Web library (Baileys-family fork). On every socket creation — the package's primary documented API...
bs58-88@6.0.1
OpenSSF/OSV malware advisory MAL-2026-11023 blocks this version. Package `bs58-88` mimics the popular `bs58` base58 encoder: README, keywords, and repository URL match the real `bs58`, an...
kelly-stake@4.1.0
OpenSSF/OSV malware advisory MAL-2026-6482 blocks this version. LPM AI assessed this version as clean; the assessments disagree. On npm install, scripts/install-check.cjs runs as a postin...