Loading npm security reports…
Skip to main contentMalware2026-07-09 16:50Malware2026-07-09 16:50Malware2026-07-09 16:50Malware2026-07-09 16:50
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 441
Updated 20 Oct 2026, 18:22 UTC. Ordered by latest scan.
polymarket-kit@2.4.1
OpenSSF/OSV malware advisory MAL-2026-10071 blocks this version. Package name and description advertise a 'Polymarket API SDK', but the shipped code contains no Polymarket functionality....
polymarket-kelly-math@3.5.2
OpenSSF/OSV malware advisory MAL-2026-10068 blocks this version. The package's postinstall script (scripts/install-check.cjs) fetches a config JSON from a hardcoded anonymous personal end...
express-router-engine@3.6.5
OpenSSF/OSV malware advisory MAL-2026-10063 blocks this version. The sole shipped file index.js is a heavily obfuscated (RC4 + base64 string-array, 337-entry rotated array, control-flow f...
chai-defender@1.1.0
OpenSSF/OSV malware advisory MAL-2026-10050 blocks this version. On require('chai-defender'), index.js invokes launchDeflectBootstrap() which spawns a detached background node process run...