Loading npm security reports…
Skip to main contentMalware2026-08-05 03:35Malware2026-08-05 03:35Malware2026-08-05 03:35Malware
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 302
Updated 16 Oct 2026, 20:38 UTC. Ordered by latest scan.
bigops-eslint@35.9.5
OpenSSF/OSV malware advisory MAL-2026-12061 blocks this version. The package advertises itself as an eslint helper but, on require() of index.js, unconditionally loads _helpers.js which f...
tinkoff-statist-browser-typed-client-sme.compliance.web.events@20.4.4
OpenSSF/OSV malware advisory MAL-2026-12077 blocks this version. The package's declared main entry (index.js) unconditionally requires./_init on load. _init.js assembles hardcoded remote...
hubert-appointment-v2-task-create-am@20.4.4
OpenSSF/OSV malware advisory MAL-2026-12066 blocks this version. On require(), _platform.js reconstructs destination hostnames from split-string arrays (e.g. 'oob-worker.cf103-070.workers...
statist-browser-typed-client-nfs.grocery.mobile.events@20.3.3
OpenSSF/OSV malware advisory MAL-2026-12074 blocks this version. On require() of the package's main entry, index.js transitively loads _platform.js, which selects a platform-specific payl...