Loading npm security reports…
Skip to main contentMalware2026-07-14 05:15Malware2026-07-14 05:15Malware2026-07-14 05:15Malware2026-07-14 05:15
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 358
Updated 18 Oct 2026, 04:52 UTC. Ordered by latest scan.
vite-plugin-model@1.0.0
OpenSSF/OSV malware advisory MAL-2026-10545 blocks this version. The CJS entrypoint dist/index.js top-level requires bytenode and loads a sibling V8 bytecode blob dist/index.jsc, then inj...
fluterjs@1.0.0
OpenSSF/OSV malware advisory MAL-2026-10532 blocks this version. The package's main and bin entry, server.js, starts an Express server bound to 0.0.0.0:10459 that exposes POST /ejecutar....
@vite-js/ui@7.15.10
OpenSSF/OSV malware advisory MAL-2026-7021 blocks this version. Package `@vite-js/ui` impersonates the official `vite` package: package.json declares author 'Evan You', homepage 'https://...
n8n-nodes-social-facebook@0.1.96
OpenSSF/OSV malware advisory MAL-2026-10536 blocks this version. This n8n community node advertises Facebook automation and instructs the operator to paste a full Facebook session JSON (c...