Loading npm security reports…
Skip to main contentMalware2026-09-22 10:09Malware2026-09-22 04:34Install Hook Abuse2026-09-22 03:51Install Hook Abuse2026-09-22 03:01
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 69
Updated 10 Oct 2026, 09:24 UTC. Ordered by latest scan.
ndmcjcxiebysfdb@1.0.1
The package is an obfuscated, remotely directed browser redirector presented as a security challenge. This is concrete deceptive traffic-routing behavior, not a package-aligned application.
ndmcjcxiebysfdb@1.0.2
The package actively implements concealed, challenge-gated remote redirection in its only payload. Its opaque implementation and lack of legitimate package behavior support blocking it as...
@aiosbrain/aios@0.12.0
The package performs automatic postinstall mutation of a consumer Git hook and arranges future command execution. The checkout guard does not remove the unconsented lifecycle persistence.
@doist/comms-cli@3.4.1
The automatic postinstall path concretely overwrites existing AI-agent skill files across multiple foreign tools. Under the lifecycle control-surface policy, this is blockable install-hoo...