Loading npm security reports…
Skip to main contentMalware2026-07-09 17:40Malware2026-07-09 17:40Malware2026-07-09 17:40Malware2026-07-09 17:40
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 438
Updated 20 Oct 2026, 16:48 UTC. Ordered by latest scan.
checkmarx-claude-cache@1.0.0
OpenSSF/OSV malware advisory MAL-2026-6576 blocks this version. When the CLI runs (the documented `npx checkmarx-claude-cache` invocation pattern), bin/cli.js performs an HTTPS GET to a h...
conversionvaluemanager@3.0.0
OpenSSF/OSV malware advisory MAL-2026-10084 blocks this version. On npm install, postinstall.js automatically runs and gathers installer-identifying data (os.hostname(), os.userInfo(), os...
poly-kelly@3.5.2
OpenSSF/OSV malware advisory MAL-2026-6584 blocks this version. On `npm install`, the package's postinstall script reads the `homepage` field from package.json (set to https://data-stream...
ai-sdk-helpers@1.4.3
OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...