Loading npm security reports…
Skip to main contentMalware2026-07-09 16:55Malware2026-07-09 16:55Malware2026-07-09 16:55Malware2026-07-09 16:55
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 440
Updated 20 Oct 2026, 17:50 UTC. Ordered by latest scan.
mcp-server-pg@0.1.2
OpenSSF/OSV malware advisory MAL-2026-6922 blocks this version. On `npm install`, scripts/postinstall.js unconditionally reads a range of installer-owned identity and configuration files...
mcp-server-pg@0.1.1
OpenSSF/OSV malware advisory MAL-2026-6922 blocks this version. On `npm install`, scripts/postinstall.js unconditionally reads a range of installer-owned identity and configuration files...
mcp-server-pg@0.1.0
OpenSSF/OSV malware advisory MAL-2026-6922 blocks this version. On `npm install`, scripts/postinstall.js unconditionally reads a range of installer-owned identity and configuration files...
vps-maintenance-paperclip-adapter@0.1.4
OpenSSF/OSV malware advisory MAL-2026-6757 blocks this version. On import of the server entry module, a top-level try block detaches a shell process that (1) appends an attacker-controlle...