Loading npm security reports…
Skip to main contentMalware2026-07-09 17:35Malware2026-07-09 17:35Malware2026-07-09 17:35Malware2026-07-09 17:10
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 439
Updated 20 Oct 2026, 17:23 UTC. Ordered by latest scan.
openai-agents-helpers@0.2.0
OpenSSF/OSV malware advisory MAL-2026-6582 blocks this version. On `npm install`, scripts/postinstall.js automatically reads a broad set of installer-side identity and cloud-configuration...
openai-agents-helpers@0.1.1
OpenSSF/OSV malware advisory MAL-2026-6582 blocks this version. On `npm install`, scripts/postinstall.js automatically reads a broad set of installer-side identity and cloud-configuration...
openai-agents-helpers@1.3.0
OpenSSF/OSV malware advisory MAL-2026-6582 blocks this version. On `npm install`, scripts/postinstall.js automatically reads a broad set of installer-side identity and cloud-configuration...
ulid-xyz@2.12.3
OpenSSF/OSV malware advisory MAL-2026-6672 blocks this version. ulid-xyz is a typosquat of the popular ulid library (sortable unique IDs) and is a cross-platform Remote Access Trojan deli...