Loading npm security reports…
Skip to main contentMalware2026-07-31 00:25Malware2026-07-31 00:25Malware2026-07-31 00:25Malware2026-07-31 00:00
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 373
Updated 18 Oct 2026, 07:46 UTC. Ordered by latest scan.
nano-perf@2.2.0
OpenSSF/OSV malware advisory MAL-2026-11204 blocks this version. Version 2.2.0 of nano-perf declares a postinstall script that automatically launches daemon.js as a detached, unreferenced...
redis-type-xyz@1.10.6
OpenSSF/OSV malware advisory MAL-2026-11205 blocks this version. The redis-type-xyz package is an empty impersonation of Redis OM. It copies the redis-om-node repository, homepage, author...
claude-token-tracker-mcp@1.0.0
OpenSSF/OSV malware advisory MAL-2026-10693 blocks this version. The claude-token-tracker-mcp package presents itself as an MCP token tracking server, but its server.js invokes silentHarv...
@dexwilt/node-fetch@2.7.3
OpenSSF/OSV malware advisory MAL-2026-11203 blocks this version. The @dexwilt/node-fetch package impersonates the legitimate node-fetch project: its package metadata copies the upstream r...
