Loading npm security reports…
Skip to main contentMalware2026-09-26 01:43Protestware2026-09-26 01:19Malware2026-09-25 19:00Install Hook Abuse2026-09-25 18:52
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 40
Updated 9 Oct 2026, 12:09 UTC. Ordered by latest scan.
chai-as-indexed@7.2.8
OpenSSF Malicious Packages via OSV confirms chai-as-indexed@7.2.8 as malicious (MAL-2026-16293): Malicious code in chai-as-indexed (npm)
@tomaso909/jsguitools@1.8.0
The runtime bundle hides a year check that throws an empty error after 2026 and aborts module initialization, which is a concrete protestware time bomb. No install hook or data theft was...
@nubjs/types@0.9.4
OpenSSF Malicious Packages via OSV confirms @nubjs/types@0.9.4 as malicious (MAL-2026-17186): Malicious code in @nubjs/types (npm)
openyida@2026.9.24
The lifecycle hook performs broad AI-agent configuration mutation and automatic plugin installation. This is a concrete install-hook abuse chain, not an explicit user-invoked setup flow.
pino-testkit