Loading npm security reports…
Skip to main contentMalware2026-08-05 06:50Malware2026-08-05 06:50Malware2026-08-05 06:50Malware2026-08-05 06:50
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 299
Updated 16 Oct 2026, 19:22 UTC. Ordered by latest scan.
exodus-payments@99.0.0-canary.1
OpenSSF/OSV malware advisory MAL-2026-10895 blocks this version. Package is self-identified as a dependency-confusion proof-of-concept. Its postinstall hook (src/canary.js) performs a DNS...
exodus-checkout@99.0.0-canary.1
OpenSSF/OSV malware advisory MAL-2026-10894 blocks this version. Package `exodus-checkout` self-identifies as a security-research dependency-confusion proof-of-concept targeting an intern...
field-plus@1.0.0
OpenSSF/OSV malware advisory MAL-2026-5777 blocks this version. package.json declares both preinstall and postinstall scripts that run curl against a hardcoded bare-IP HTTP endpoint (http...
fazzgram@0.1.1
OpenSSF/OSV malware advisory MAL-2026-11086 blocks this version. fazzgram is a Telegram Bot API wrapper. Supporting modules (ApiClient.js, Dispatcher.js, LongPoller.js, WebhookServer.js,...