Loading npm security reports…
Skip to main contentMalware2026-09-24 02:35Malware2026-09-24 02:35Malware2026-09-24 02:35Malware2026-09-24 02:35
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 59
Updated 10 Oct 2026, 02:16 UTC. Ordered by latest scan.
epic-fortnite-react@1.0.0
OpenSSF Malicious Packages via OSV confirms epic-fortnite-react@1.0.0 as malicious (MAL-2025-49146): Malicious code in epic-fortnite-react (npm)
epic-fortnite-build@1.0.0
OpenSSF Malicious Packages via OSV confirms epic-fortnite-build@1.0.0 as malicious (MAL-2025-49145): Malicious code in epic-fortnite-build (npm)
epic-file-upload@1.0.0
OpenSSF Malicious Packages via OSV confirms epic-file-upload@1.0.0 as malicious (MAL-2025-49144): Malicious code in epic-file-upload (npm)
epic-eula-service@1.0.0
OpenSSF Malicious Packages via OSV confirms epic-eula-service@1.0.0 as malicious (MAL-2025-49143): Malicious code in epic-eula-service (npm)
epic-eula@1.0.0
OpenSSF Malicious Packages via OSV confirms epic-eula@1.0.0 as malicious (MAL-2025-49142): Malicious code in epic-eula (npm)
