Loading npm security reports…
Skip to main contentMalware2026-07-08 21:10Malware2026-07-08 21:10Malware2026-07-08 21:10Malware2026-07-08 21:10
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 483
Updated 21 Oct 2026, 21:00 UTC. Ordered by latest scan.
livekit-agents@0.3.5
OpenSSF/OSV malware advisory MAL-2026-6555 blocks this version. The unscoped npm package `livekit-agents` advertises itself in README as the official LiveKit Agents SDK and links to livek...
yastatic-s3@0.1.99
OpenSSF/OSV malware advisory MAL-2026-6586 blocks this version. Package name mimics Yandex's `yastatic` static-asset namespace. On install, postinstall.js performs an unconditional plain-...
yastatic-s3@0.1.10
OpenSSF/OSV malware advisory MAL-2026-6586 blocks this version. Package name mimics Yandex's `yastatic` static-asset namespace. On install, postinstall.js performs an unconditional plain-...
yastatic-s3@0.1.0
OpenSSF/OSV malware advisory MAL-2026-6586 blocks this version. Package name mimics Yandex's `yastatic` static-asset namespace. On install, postinstall.js performs an unconditional plain-...