Loading npm security reports…
Skip to main contentMalware2026-07-08 17:25Malware2026-07-08 17:25Malware2026-07-08 17:25Malware2026-07-08 17:25
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 439
Updated 19 Oct 2026, 19:17 UTC. Ordered by latest scan.
ts-ecro-helper@0.0.1
OpenSSF/OSV malware advisory MAL-2026-6204 blocks this version. No suspicious behaviors were identified in this package version. There are no lifecycle hook hazards, no outbound network c...
parket-helper@0.0.1
OpenSSF/OSV malware advisory MAL-2026-6119 blocks this version. index.js imports child_process and invokes execSync with bash and zsh shells (lines 315 and 331). Without traced reachabili...
ai-node-relay@0.0.1
OpenSSF/OSV malware advisory MAL-2026-6518 blocks this version. ai-node-relay ships dist/index.js as its npm main entry, processed with javascript-obfuscator (string-array rotation, _0x-p...
opt-archetype-check@9.99.4
OpenSSF/OSV malware advisory MAL-2026-6075 blocks this version. On `npm install`, the package's postinstall hook executes `node index.js`, which collects the installer's public IP (via ap...