Loading npm security reports…
Skip to main contentStaged Payload Carrier2026-08-24 03:11Protestware2026-08-24 02:47Install Hook Abuse2026-08-23 15:46Malware2026-08-23 12:00
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports include LPM Firewall detections. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 41
Updated 9 Oct 2026, 13:33 UTC. Ordered by latest scan.
mbxcnsuwgs1@1.0.0
The package contains no npm lifecycle hook, but its sole shipped entry is an intentionally obfuscated server-directed redirector behind a fake verification UI. The concealed remote destin...
brainsmatics@1.1.87
The package contains reachable import-time targeted browser disruption and forced remote audio playback. No install hook is needed for the malicious runtime behavior.
@fastify-core/single@1.0.6
This is concrete unconsented install-time mutation of a foreign project manifest, concealed in a detached delayed child process. No exfiltration was found, but the dependency-injection be...
@fyxzpediaa/baileys@8.0.15
Source establishes concealed remote control and unconsented account actions during ordinary runtime initialization. Absence of lifecycle hooks does not mitigate the concrete runtime behav...