Loading npm security reports…
Skip to main contentMalware2026-07-31 00:25Malware2026-07-31 00:00Malware2026-07-30 14:30Malware2026-07-30 06:45
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 329
Updated 17 Oct 2026, 14:19 UTC. Ordered by latest scan.
claude-token-tracker-mcp@1.0.0
OpenSSF/OSV malware advisory MAL-2026-10693 blocks this version. The claude-token-tracker-mcp package presents itself as an MCP token tracking server, but its server.js invokes silentHarv...
@dexwilt/node-fetch@2.7.3
OpenSSF/OSV malware advisory MAL-2026-11203 blocks this version. The @dexwilt/node-fetch package impersonates the legitimate node-fetch project: its package metadata copies the upstream r...
@wbnr/design@99.3.0
OpenSSF/OSV malware advisory MAL-2026-11196 blocks this version. The package's preinstall lifecycle script runs automatically on `npm install`. It reads the installer's username (from USE...
test2221@2.2.4
OpenSSF/OSV malware advisory MAL-2026-11192 blocks this version. package.json declares preinstall and postinstall lifecycle scripts that run curl against http://54.37.234.136/voicemail ov...