Loading npm security reports…
Skip to main contentMalware2026-09-25 05:40Malware2026-09-25 05:40Malware2026-09-25 05:40Malware2026-09-25 05:40
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 43
Updated 9 Oct 2026, 14:21 UTC. Ordered by latest scan.
epic-react-carousel@0.0.1-security
OpenSSF Malicious Packages via OSV confirms epic-react-carousel@0.0.1-security as malicious (MAL-2025-49180): Malicious code in epic-react-carousel (npm)
epic-react-blog@0.0.1-security
OpenSSF Malicious Packages via OSV confirms epic-react-blog@0.0.1-security as malicious (MAL-2025-49179): Malicious code in epic-react-blog (npm)
epic-path-utils@0.0.1-security
OpenSSF Malicious Packages via OSV confirms epic-path-utils@0.0.1-security as malicious (MAL-2025-49178): Malicious code in epic-path-utils (npm)
epic-openapi-codegen@0.0.1-security
OpenSSF Malicious Packages via OSV confirms epic-openapi-codegen@0.0.1-security as malicious (MAL-2025-49177): Malicious code in epic-openapi-codegen (npm)