Loading npm security reports…
Skip to main contentMalware2026-07-08 22:00Malware2026-07-08 22:00Malware2026-07-08 22:00Malware2026-07-08 21:30
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 482
Updated 21 Oct 2026, 20:23 UTC. Ordered by latest scan.
mci-sdk@1.2.9
OpenSSF/OSV malware advisory MAL-2026-5931 blocks this version. On `npm install`, mci-sdk runs the postinstall hook `node./src/exec.js`, which imports `mci` from `src/core/index.js` and i...
rbac-auth@1.0.6
OpenSSF/OSV malware advisory MAL-2026-5873 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
clx-cookieparser@1.5.1
OpenSSF/OSV malware advisory MAL-2026-6661 blocks this version. Package ships a verbatim copy of the Express 'cookie-parser' middleware under a different name ('clx-cookieparser') and dec...
@vite-js/ui@7.15.16
OpenSSF/OSV malware advisory MAL-2026-7021 blocks this version. Package `@vite-js/ui` impersonates the official `vite` package: package.json declares author 'Evan You', homepage 'https://...