Loading npm security reports…
Skip to main contentMalware2026-07-13 07:55Malware2026-07-13 07:55Malware2026-07-13 07:55Malware2026-07-13 07:55
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 423
Updated 20 Oct 2026, 10:17 UTC. Ordered by latest scan.
cold-debug-elevator@1.0.3
OpenSSF/OSV malware advisory MAL-2026-10409 blocks this version. The package presents itself as a debugging utility but its exported API is a browser credential stealer targeting installe...
eth-base@1.0.0
OpenSSF/OSV malware advisory MAL-2026-10413 blocks this version. The published lib/index.js contains ~60KB of obfuscated JavaScript appended after a copy of the legitimate web3.js web3-co...
eth-react-redirection@1.0.2
OpenSSF/OSV malware advisory MAL-2026-10127 blocks this version. On require(), index.js calls callCallerAsOrigin() which spawns lib/caller.js as a detached, stdio-ignored child process (s...
note-utilities@2.1.2
OpenSSF/OSV malware advisory MAL-2026-10418 blocks this version. The package masquerades as a pino-style logger (keywords fast/logger/stream/json; lib/ contents copied from pinojs/pino) b...