Loading npm security reports…
Skip to main contentMalware2026-08-05 02:15Malware2026-08-05 02:15Malware2026-08-05 02:15Malware2026-08-05 02:10
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 318
Updated 17 Oct 2026, 03:50 UTC. Ordered by latest scan.
uibabai@5.7.5
OpenSSF/OSV malware advisory MAL-2026-12054 blocks this version. index.js has malicious code appended after a legitimate Tailwind plugin export. On any require()/import of the package, th...
streak-day-utils@1.0.0
OpenSSF/OSV malware advisory MAL-2026-12047 blocks this version. index.mjs schedules an asynchronous routine at module load that decodes a table of hex-encoded strings to reconstruct refe...
n8n-nodes-probe@1.0.4
OpenSSF/OSV malware advisory MAL-2026-10777 blocks this version. The package advertises itself as an n8n community-node utility but its main entry index.js executes a recon routine at mod...
sextant-cli-linux-amd64@0.0.1-rc26
OpenSSF/OSV malware advisory MAL-2026-12029 blocks this version. sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay a...