Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-03 22:53Install Hook Abuse2026-09-03 22:53Malware2026-09-03 17:38Malware2026-09-03 16:30
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 94
Updated 11 Oct 2026, 02:23 UTC. Ordered by latest scan.
1nestjs@0.0.1
This is an automatic install-time credential-harvesting and reverse-shell payload, reinforced by explicit typosquat metadata. It warrants blocking.
0nestjs@0.0.1
This is an automatic install-time credential-exfiltration and reverse-shell chain, not a user-invoked administrative feature. The hard-coded external server and typosquat metadata further...
caphsmgiwy@1.0.1
This is a concealed, remotely controlled browser redirect packaged as an npm entry point. The lack of install hooks does not mitigate the delivered phishing or malware-routing behavior.
@quantixfinance/token@1.0.0
OpenSSF Malicious Packages via OSV confirms @quantixfinance/token@1.0.0 as malicious (MAL-2026-15854): Malicious code in @quantixfinance/token (npm)