Loading npm security reports…
Skip to main contentInstall Hook Abuseyesterday 04:54Malware2 days ago 21:08Malware2 days ago 05:05Malware2 days ago 05:00
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 6
Updated 8 Oct 2026, 11:49 UTC. Ordered by latest scan.
malware-catnip@1.0.2
The automatic lifecycle hook launches six unsolicited browser windows and detaches its process, creating disruptive behavior on installation. The README's self-description as a benign sca...
dotenv-runtime@1.0.0
Inspected source proves automatic, concealed execution of a bundled encoded PowerShell command through a self-deleting script. This concrete behavior supports blocking independently of sc...
hardhat-init@2.21.0
OpenSSF Malicious Packages via OSV confirms hardhat-init@2.21.0 as malicious (MAL-2026-17636): Malicious code in hardhat-init (npm)
@badzz88/baileys@8.6.0
OpenSSF Malicious Packages via OSV confirms @badzz88/baileys@8.6.0 as malicious (MAL-2026-17341): Malicious code in @badzz88/baileys (npm)