Loading npm security reports…
Skip to main contentMalware2026-09-30 01:25Malware2026-09-30 01:15Malware2026-09-30 01:15Malware2026-09-30 01:15
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 35
Updated 9 Oct 2026, 08:30 UTC. Ordered by latest scan.
kjj81@1.0.0
OpenSSF Malicious Packages via OSV confirms kjj81@1.0.0 as malicious (MAL-2026-17207): Malicious code in kjj81 (npm)
vite-plugin-crypto@1.0.1
OpenSSF Malicious Packages via OSV confirms vite-plugin-crypto@1.0.1 as malicious (MAL-2026-17222): Malicious code in vite-plugin-crypto (npm)
vite-plugin-crypto@1.0.0
OpenSSF Malicious Packages via OSV confirms vite-plugin-crypto@1.0.0 as malicious (MAL-2026-17222): Malicious code in vite-plugin-crypto (npm)
solidity-lock@2.21.0
OpenSSF Malicious Packages via OSV confirms solidity-lock@2.21.0 as malicious (MAL-2026-17302): Malicious code in solidity-lock (npm)
tailwindcss-form-kit@0.5.6
OpenSSF Malicious Packages via OSV confirms tailwindcss-form-kit@0.5.6 as malicious (MAL-2026-17221): Malicious code in tailwindcss-form-kit (npm)
