Loading npm security reports…
Skip to main contentMalware2026-07-01 19:35Malware2026-07-01 19:35Malware2026-07-01 18:40Malware2026-07-01 17:49
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 515
Updated 22 Oct 2026, 15:37 UTC. Ordered by latest scan.
base58-core@1.0.5
OpenSSF/OSV malware advisory MAL-2026-6445 blocks this version. The package advertises itself as a Base58 encoder/decoder but on require() schedules a delayed payload that performs multip...
base58-core@1.0.4
OpenSSF/OSV malware advisory MAL-2026-6445 blocks this version. The package advertises itself as a Base58 encoder/decoder but on require() schedules a delayed payload that performs multip...
nolimit-agent@1.0.315
Static source inspection shows a purpose-built phishing/spam delivery toolkit with explicit security-gateway evasion, not merely a benign mailer. Although there is no confirmed automatic...
svgson-lite@1.0.7
OpenSSF/OSV malware advisory MAL-2026-6707 blocks this version. index.js exports an undocumented getPlugin() function which, when invoked, performs an HTTP GET to https://shorturl.at/147u...