Loading npm security reports…
Skip to main contentMalware2026-07-13 18:40Malware2026-07-13 18:40Malware2026-07-13 18:40Malware2026-07-13 18:40
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 409
Updated 20 Oct 2026, 03:14 UTC. Ordered by latest scan.
node-procmetrics-data@1.0.1
OpenSSF/OSV malware advisory MAL-2026-10464 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. node-procmetrics-data@1.0.1 ships archive-sender.js...
gptlite@4.0.8
OpenSSF/OSV malware advisory MAL-2026-10461 blocks this version. The package's npm preinstall lifecycle script (preinstall.js, referenced from package.json's "preinstall": "node preinstal...
node-path-addon@1.0.8
OpenSSF/OSV malware advisory MAL-2026-10463 blocks this version. node-path-addon presents itself as an extension of the Node.js built-in 'path' module. Its main entry (path.js) delegates...
cktool-core@1.0.2
OpenSSF/OSV malware advisory MAL-2026-10457 blocks this version. cktool-core is the unscoped public-registry form of the private-scoped @apple/cktool.core package. Installers whose resolv...