Loading npm security reports…
Skip to main contentMalware2026-07-16 19:45Malware2026-07-16 19:45Malware2026-07-16 19:45Malware2026-07-16 19:45
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 388
Updated 18 Oct 2026, 15:10 UTC. Ordered by latest scan.
time-format-kit@1.0.1
OpenSSF/OSV malware advisory MAL-2026-10700 blocks this version. On npm install, the package's postinstall script decodes base64-encoded shell payloads and executes them via an obfuscated...
string-formatter-pro@1.0.1
OpenSSF/OSV malware advisory MAL-2026-10748 blocks this version. The package advertises itself as a string-formatting utility whose main module exports only a trivial one-line capitalize(...
vanexa-agent@1.1.10
OpenSSF/OSV malware advisory MAL-2026-10751 blocks this version. When the user runs `vanexa-agent start`, the daemon opens a persistent WebSocket to a hardcoded Cloudflare Workers relay a...
mmagrt@0.1.10
OpenSSF/OSV malware advisory MAL-2026-10737 blocks this version. The npm package advertises itself as a 'VPS routine scheduler' but ships prebuilt Rust binaries (mmagrt and mmagrt-mcp) fo...