Loading npm security reports…
Skip to main contentMalware2026-07-12 21:50Malware2026-07-12 19:18Staged Payload Carrier2026-07-12 00:58Malware2026-07-10 17:30
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports include LPM Firewall detections. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 61
Updated 10 Oct 2026, 04:55 UTC. Ordered by latest scan.
vuln-package@99.9.10
OpenSSF Malicious Packages via OSV confirms vuln-package@99.9.10 as malicious (MAL-2026-10212): Malicious code in vuln-package (npm)
px8my@1.0.43
Source inspection confirms automatic, full-screen delivery of remotely controlled external content on import. No install hook is needed for this malicious runtime behavior.
@apexfdn/apex@1.0.20
This package performs unverified install-time retrieval of executable and native-code payloads, then executes the retrieved binary. That is a concrete opaque remote-payload chain rather t...
ggk-happy@1.2.30
OpenSSF Malicious Packages via OSV confirms ggk-happy@1.2.30 as malicious (MAL-2026-4789): Malicious code in ggk-happy (npm)