Loading npm security reports…
Skip to main contentMalware2026-07-06 19:20Malware2026-07-06 19:20Malware2026-07-06 19:20Malware2026-07-06 19:20
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 503
Updated 22 Oct 2026, 08:30 UTC. Ordered by latest scan.
environment-gate@7.3.5
OpenSSF/OSV malware advisory MAL-2026-5743 blocks this version. index.js contains a commented-out line that, if uncommented, would base64-decode the URL https://www.jsonkeeper.com/b/VKUNI...
ts-eslint-helper@4.0.1
OpenSSF/OSV malware advisory MAL-2026-6721 blocks this version. The package's index.js defines run()/from_str() that recursively walk process.cwd() and match files named.env, env, id.json...
webpack-patch@1.1.7
OpenSSF/OSV malware advisory MAL-2026-5581 blocks this version. Package impersonates the webpack ecosystem but is unrelated to webpack. When the exported middleware is invoked, index.js s...
bootstrap-utils@4.5.0
OpenSSF/OSV malware advisory MAL-2026-6807 blocks this version. The package's index.js is heavily obfuscated with classic string-array shuffling patterns (e.g., while(!![]) loops with rep...