Loading npm security reports…
Skip to main contentMalware2026-09-25 05:40Malware2026-09-25 05:40Malware2026-09-25 05:40Malware2026-09-25 05:40
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 44
Updated 9 Oct 2026, 15:04 UTC. Ordered by latest scan.
epic-offline-token-verifier-node@1.0.0
OpenSSF Malicious Packages via OSV confirms epic-offline-token-verifier-node@1.0.0 as malicious (MAL-2025-49175): Malicious code in epic-offline-token-verifier-node (npm)
epic-node-services-common@1.0.0
OpenSSF Malicious Packages via OSV confirms epic-node-services-common@1.0.0 as malicious (MAL-2025-49174): Malicious code in epic-node-services-common (npm)
epic-node-services@1.0.0
OpenSSF Malicious Packages via OSV confirms epic-node-services@1.0.0 as malicious (MAL-2025-49173): Malicious code in epic-node-services (npm)
epic-node-sailthru@1.0.0
OpenSSF Malicious Packages via OSV confirms epic-node-sailthru@1.0.0 as malicious (MAL-2025-49172): Malicious code in epic-node-sailthru (npm)