Loading npm security reports…
Skip to main contentMalware1 hour agoMalware1 hour agoMalware1 hour agoMalware1 hour ago
npm threat feed
Malicious packages, on record.
Track recently blocked npm package versions from LPM Firewall scans and public OSV/GHSA advisories. Open any row for the affected version, evidence summary, verdict source, and current install policy.
Latest blocked packages
Cache refreshed 18 Aug 2026, 02:25 UTC. Refreshes when new reports are published.
runtime-health@1.0.4
OpenSSF Malicious Packages via OSV confirms runtime-health@1.0.4 as malicious (MAL-2026-14116): Malicious code in runtime-health (npm)
runtime-health@1.0.2
OpenSSF Malicious Packages via OSV confirms runtime-health@1.0.2 as malicious (MAL-2026-14116): Malicious code in runtime-health (npm)
envfile-sync-cli@3.0.0
OpenSSF Malicious Packages via OSV confirms envfile-sync-cli@3.0.0 as malicious (MAL-2026-6590): Malicious code in envfile-sync-cli (npm)
envfile-sync-cli@2.0.0
OpenSSF Malicious Packages via OSV confirms envfile-sync-cli@2.0.0 as malicious (MAL-2026-6590): Malicious code in envfile-sync-cli (npm)
envfile-sync-cli@1.0.2
OpenSSF Malicious Packages via OSV confirms envfile-sync-cli@1.0.2 as malicious (MAL-2026-6590): Malicious code in envfile-sync-cli (npm)
