Loading npm security reports…
Skip to main contentMalware2026-07-08 17:25Malware2026-07-08 17:25Malware2026-07-08 17:25Malware2026-07-08 17:25
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 438
Updated 19 Oct 2026, 18:55 UTC. Ordered by latest scan.
@vite-tab/tab@3.15.10
OpenSSF/OSV malware advisory MAL-2026-6988 blocks this version. `@vite-tab/tab` republishes Vite's codebase under a different name while impersonating the upstream project: `package.json`...
@epic-common/observability-node@0.0.1
OpenSSF/OSV malware advisory MAL-2026-6562 blocks this version. Package targets the private @epic-common scope (Epic Games) and is published to the public npm registry as a dependency-con...
@epic-common/observability-node@10.10.2
OpenSSF/OSV malware advisory MAL-2026-6562 blocks this version. Package targets the private @epic-common scope (Epic Games) and is published to the public npm registry as a dependency-con...
nbmolviz-js@0.0.1
OpenSSF/OSV malware advisory MAL-2026-6683 blocks this version. No a static rule matches and no traced behavior of concern were identified in this package version. No evidence of credenti...