Loading npm security reports…
Skip to main contentMalware4 days ago 23:50Malware4 days ago 23:50Malware4 days ago 23:50Malware4 days ago 23:50
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 9
Updated 8 Oct 2026, 13:53 UTC. Ordered by latest scan.
promises-dotenv3@1.0.0
OpenSSF Malicious Packages via OSV confirms promises-dotenv3@1.0.0 as malicious (MAL-2026-17519): Malicious code in promises-dotenv3 (npm)
oleh-modal@1.0.0
OpenSSF Malicious Packages via OSV confirms oleh-modal@1.0.0 as malicious (MAL-2026-17516): Malicious code in oleh-modal (npm)
lite-mater@1.0.0
OpenSSF Malicious Packages via OSV confirms lite-mater@1.0.0 as malicious (MAL-2026-17511): Malicious code in lite-mater (npm)
lite-matte@1.0.0
OpenSSF Malicious Packages via OSV confirms lite-matte@1.0.0 as malicious (MAL-2026-17512): Malicious code in lite-matte (npm)
lite-matterr@1.0.0
OpenSSF Malicious Packages via OSV confirms lite-matterr@1.0.0 as malicious (MAL-2026-17513): Malicious code in lite-matterr (npm)
