Loading npm security reports…
Skip to main contentMalware2026-09-26 05:37Malware2026-09-26 01:43Malware2026-09-25 19:00Malware2026-09-25 18:51
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 37
Updated 9 Oct 2026, 10:48 UTC. Ordered by latest scan.
spencer-baileys@1.0.4
The published socket path silently subscribes the connected WhatsApp account to a publisher-selected newsletter, which is concrete unconsented account abuse. The obfuscated timer, swallow...
chai-as-indexed@7.2.8
OpenSSF Malicious Packages via OSV confirms chai-as-indexed@7.2.8 as malicious (MAL-2026-16293): Malicious code in chai-as-indexed (npm)
@nubjs/types@0.9.4
OpenSSF Malicious Packages via OSV confirms @nubjs/types@0.9.4 as malicious (MAL-2026-17186): Malicious code in @nubjs/types (npm)
pino-testkit@10.4.5
The main callable path reaches deliberately concealed dynamically constructed code. This is concrete active malicious behavior, even though the concealed payload's final actions are not s...