Loading npm security reports…
Skip to main contentMalware2026-07-23 17:21Staged Payload Carrier2026-07-23 09:44Malware2026-07-23 08:30Malware2026-07-23 08:30
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 381
Updated 18 Oct 2026, 11:35 UTC. Ordered by latest scan.
quickbuf@1.0.6
The native addon’s imported APIs and embedded anti-analysis/staging indicators are materially inconsistent with a buffer utility. The absence of install hooks does not mitigate import-tim...
gekko-trading-bot@4.2.0
The unconditional postinstall download of an unsigned executable from an unrelated C2-named host is concrete malicious payload staging, despite no execution call in the inspected source.
cktool-core@1.0.4
OpenSSF/OSV malware advisory MAL-2026-10457 blocks this version. cktool-core is the unscoped public-registry form of the private-scoped @apple/cktool.core package. Installers whose resolv...
cktool-core@1.0.3
OpenSSF/OSV malware advisory MAL-2026-10457 blocks this version. cktool-core is the unscoped public-registry form of the private-scoped @apple/cktool.core package. Installers whose resolv...