Loading npm security reports…
Skip to main contentMalware2026-06-30 15:00Malware2026-06-30 15:00Malware2026-06-30 15:00Malware2026-06-30 15:00
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 474
Updated 20 Oct 2026, 13:20 UTC. Ordered by latest scan.
web3-eth-util@6.2.8
OpenSSF/OSV malware advisory MAL-2026-6325 blocks this version. Package name and metadata impersonate the legitimate @ethereumjs/util / ethereumjs-util packages: README is copied verbatim...
assertcore@3.1.7
OpenSSF/OSV malware advisory MAL-2026-6365 blocks this version. Package `assertcore` impersonates the popular `chai` assertion library (ships a copy of chai source as cover; author and ho...
@dervix/ws@8.21.4
OpenSSF/OSV malware advisory MAL-2026-6496 blocks this version. Package `@dervix/ws` impersonates the popular `ws` WebSocket library — `package.json` copies the legitimate ws project's ho...
@osmura/treeify@1.1.3
OpenSSF/OSV malware advisory MAL-2026-6542 blocks this version. The package republishes the upstream `treeify` library (Luke Plaster, repo notatestuser/treeify) verbatim under the unrelat...