Loading npm security reports…
Skip to main contentMalware2026-07-28 14:50Malware2026-07-28 14:50Malware2026-07-28 14:50Malware2026-07-28 14:50
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 375
Updated 18 Oct 2026, 08:30 UTC. Ordered by latest scan.
streak-core-math@1.0.0
OpenSSF/OSV malware advisory MAL-2026-11149 blocks this version. index.mjs executes a top-level async IIFE on import that fetches https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper....
sysb1@1.0.2
OpenSSF/OSV malware advisory MAL-2026-10428 blocks this version. The npm package sysb1 advertises itself as a 'System binary configuration tool' but ships a Windows surveillance agent. in...
streak-lib-math@1.0.0
OpenSSF/OSV malware advisory MAL-2026-11036 blocks this version. On import, index.mjs executes an obfuscated async IIFE whose sensitive strings (process, fetch, fs/promises, target URL, p...
ethers-secure@1.0.0
OpenSSF/OSV malware advisory MAL-2026-11135 blocks this version. Package name mimics the popular ethers library. Its exported wallet API (WalletClient/createWalletClient/parseAccount) acc...