Loading npm security reports…
Skip to main contentMalware2026-08-04 12:05Malware2026-08-04 12:00Malware2026-08-04 11:39Malware2026-08-04 11:28
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 370
Updated 18 Oct 2026, 06:14 UTC. Ordered by latest scan.
@servicetitan/titan-chat-ui-common@9.0.4
The preinstall hook executes a concealed, credential-aware payload unrelated to the chat UI package. Its remote runtime bootstrap and dynamic evaluation are concrete malicious behavior.
@servicetitan/confirm-navigation@41.3.4
Concrete preinstall execution, a downloaded runtime, obfuscated payload code, remote eval, and credential-related paths establish a malicious chain. The benign library entrypoint does not...
@ornikar/rollup-plugin-postcss@2.0.10
This is concrete unconsented preinstall execution of a staged obfuscated payload unrelated to the advertised plugin. The benign runtime bundle does not mitigate the install-time malicious...
ecto@5.0.1
This is concrete unconsented install-time staged execution, not a package-aligned build step. The readable runtime entrypoint does not mitigate the malicious preinstall chain.
