Loading npm security reports…
Skip to main contentMalware2026-09-04 05:50Install Hook Abuse2026-09-04 05:28Install Hook Abuse2026-09-04 05:21Malware2026-09-04 04:32
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports include LPM Firewall detections. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 31
Updated 9 Oct 2026, 06:35 UTC. Ordered by latest scan.
taskforge-9xv@1.3.0
OpenSSF Malicious Packages via OSV confirms taskforge-9xv@1.3.0 as malicious (MAL-2026-15914): Malicious code in taskforge-9xv (npm)
@codyswann/lisa@4.34.13
The inspected source establishes an automatic install-time chain that mutates consumer and user AI-agent configuration. This meets the policy boundary for unconsented lifecycle control-su...
x3r0day-bunnyhijack-poc@1.0.1
The package deliberately impersonates Node to intercept dependency lifecycle execution and performs unconsented local and browser side effects before forwarding the command. Its lack of i...
adbf@1.0.113
The opaque runtime is not aligned with the minimal package metadata and deliberately hides an AI-message steering path. Although it has no install hook, the concrete user-invoked behavior...