Loading npm security reports…
Skip to main contentProtestwareyesterday 19:23Malwareyesterday 19:20Install Hook Abuseyesterday 04:54Malware2 days ago 21:08
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports include LPM Firewall detections. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 3
Updated 8 Oct 2026, 10:23 UTC. Ordered by latest scan.
threshold-engine@2026.9.14-staging.bootstrap.1
The published entrypoint contains active, targeted browser disruption behavior that is unrelated to a threshold compiler’s function. This supports a malicious protestware verdict and block.
hardhat-bits@2.21.0
The package entrypoint loads a heavily obfuscated module that invokes shell execution and includes network capability. This concrete, reachable behavior warrants blocking despite the exac...
malware-catnip@1.0.2
The automatic lifecycle hook launches six unsolicited browser windows and detaches its process, creating disruptive behavior on installation. The README's self-description as a benign sca...
dotenv-runtime@1.0.0
Inspected source proves automatic, concealed execution of a bundled encoded PowerShell command through a self-deleting script. This concrete behavior supports blocking independently of sc...