Loading npm security reports…
Skip to main contentMalware2026-07-13 05:40Malware2026-07-13 05:40Malware2026-07-13 05:40Malware2026-07-13 05:40
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 424
Updated 20 Oct 2026, 10:45 UTC. Ordered by latest scan.
getd-transactional-web@0.0.1
OpenSSF/OSV malware advisory MAL-2026-5469 blocks this version. On `npm install`, postinstall.js issues an HTTPS GET to https://webhook.site/18dc4281-d366-438a-9186-76fbcd56ade5 carrying...
getd-pantallas-cliente@0.0.1
OpenSSF/OSV malware advisory MAL-2026-5468 blocks this version. On `npm install`, postinstall.js collects os.hostname(), os.userInfo().username, os.platform(), process.cwd(), and CI/build...
getd-handler-api@0.0.1
OpenSSF/OSV malware advisory MAL-2026-5467 blocks this version. On `npm install`, postinstall.js collects the installer's hostname, username, platform, current working directory, and CI-r...
getd-eslint-rules@0.0.1
OpenSSF/OSV malware advisory MAL-2026-5466 blocks this version. On `npm install`, postinstall.js collects host identifiers (os.hostname, os.userInfo username, os.platform, current working...
