Loading npm security reports…
Skip to main contentMalware2026-08-05 18:20Malware2026-08-05 17:20Staged Payload Carrier2026-08-05 17:14Malware2026-08-05 16:48
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports include LPM Firewall detections. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 54
Updated 9 Oct 2026, 23:36 UTC. Ordered by latest scan.
bigops-telephony@35.8.4
This is concrete import-time remote payload execution, not package-aligned telemetry. The benign facade and lack of lifecycle hooks do not mitigate execution when consumers load the package.
native-hello-plugin@1.2.0
OpenSSF Malicious Packages via OSV confirms native-hello-plugin@1.2.0 as malicious (MAL-2026-13350): Malicious code in native-hello-plugin (npm)
claims-microgen-templates@35.7.1
This is a concrete import-time staged-payload execution chain unrelated to the declared template interface. The absence of lifecycle hooks does not mitigate execution on normal package use.
bigops-products-insurance@35.3.4
The benign exported API is a wrapper around automatic import-time remote binary execution. This is concrete malware behavior, not telemetry or a user-invoked optional setup path.