Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-08-11 10:15Malware2026-08-10 21:52Malware2026-08-10 21:49
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports include LPM Firewall detections. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 50
Updated 9 Oct 2026, 20:24 UTC. Ordered by latest scan.
augustdigital-sdk@8.20.1
The package has a concrete, concealed install-time data-exfiltration path. The Sentry dynamic require is package-aligned and does not mitigate the lifecycle-hook behavior.
egair0810@1.0.0
Source inspection confirms a concealed, automatic browser-redirection chain behind a security-verification lure. Absence of install hooks does not mitigate the delivered malicious runtime...
@jacksher/install-exec-poc@1.0.2
Direct source inspection confirms unconsented install-time remote beaconing and shell execution. The claimed PoC purpose does not remove the concrete behavior affecting every installer.
@jacksher/install-exec-poc@1.0.0
Direct source inspection confirms unconsented install-time network activity, not merely a static hint. No broader payload behavior was found, but the concrete lifecycle beacon warrants bl...