Loading npm security reports…
Skip to main contentMalware2026-07-05 02:31Malware2026-07-04 23:54Install Hook Abuse2026-07-04 23:51
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports include LPM Firewall detections. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 62
Updated 10 Oct 2026, 05:41 UTC. Ordered by latest scan.
base58-core@1.0.11
Source inspection confirms malicious functionality in both published entrypoints that is unrelated to Base58 encoding. The activation guard weakens reachability but the package still carr...
@tqm-mfe/main@5.4.7
The package has concrete malicious install-time behavior: a hidden obfuscated postinstall with host reconnaissance, command execution primitives, filesystem mutation, detached execution,...
@car_loans/dealerships-approval@7.1.5
Source inspection confirms a malicious install-time hook with hidden execution, persistence-like detached launch behavior, and system telemetry collection. The benign README and metadata...
@car_loans/dealerships-approval@7.1.6
The lifecycle hook is a concrete install-time dropper/launcher, not merely telemetry or package-aligned setup. The obfuscation, anti-analysis, detached execution, and broken advertised mo...