Loading npm security reports…
Skip to main contentMalware2026-09-15 17:00Malware2026-09-15 17:00Install Hook Abuse2026-09-15 16:44Install Hook Abuse2026-09-15 16:33
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 78
Updated 10 Oct 2026, 15:02 UTC. Ordered by latest scan.
fulfillment-cuprum-auth-widget@3.7.2
OpenSSF Malicious Packages via OSV confirms fulfillment-cuprum-auth-widget@3.7.2 as malicious (MAL-2026-16176): Malicious code in fulfillment-cuprum-auth-widget (npm)
meraz-project-tracker@1.0.0
OpenSSF Malicious Packages via OSV confirms meraz-project-tracker@1.0.0 as malicious (MAL-2026-16161): Malicious code in meraz-project-tracker (npm)
termdock@1.4.232
The package's automatic postinstall makes privileged host-level software changes and its runtime path repeats the behavior. No exfiltration was confirmed, but the unconsented lifecycle mu...
@wwkit/sshproxy@1.0.10
The install hook automatically performs remote SSH key persistence and starts background services. This is concrete unconsented install-time behavior, not merely a user-invoked SSH utility.