Loading npm security reports…
Skip to main contentMalware2026-07-09 16:50Malware2026-07-09 16:50Malware2026-07-09 16:50Malware2026-07-09 16:50
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 442
Updated 20 Oct 2026, 18:58 UTC. Ordered by latest scan.
chai-deflect@1.1.5
OpenSSF/OSV malware advisory MAL-2026-10051 blocks this version. On require('chai-deflect'), index.js top-level invokes launchDeflectBootstrap() which detaches a child process running lib...
nps-retrieval-diagnostics@9.9.9
OpenSSF/OSV malware advisory MAL-2026-10066 blocks this version. The package's bin entry (`retrieval-diagnostics`) installs an attacker-controlled persistence footprint on the host when i...
chai-smart@2.3.5
OpenSSF/OSV malware advisory MAL-2026-10054 blocks this version. The package presents a pino-like logger API but its exported middleware spawns a detached `node` child process running lib...
paperclip-adapter-helpers@1.0.13
OpenSSF/OSV malware advisory MAL-2026-6981 blocks this version. paperclip-adapter-helpers@1.0.7 executes a credential-theft and C2 backdoor automatically on import. The package's main re-...