Loading npm security reports…
Skip to main contentPersistence2026-07-22 12:46Persistence2026-07-22 12:46Persistence2026-07-20 13:39Persistence2026-07-20 13:04
npm threat feed
npm persistence and destructive behavior reports.
Investigate persistence and destructive actions, including unwanted lasting changes, damaged files, and disrupted systems. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 2
Updated 8 Oct 2026, 09:34 UTC. Ordered by latest scan.
calmora@1.0.1
Source inspection confirms concrete import-time remote payload delivery and Startup-folder persistence, inconsistent with the documented calendar utility. This is malicious behavior, not...
korvica@1.0.0
The package contains a concealed import-time remote payload delivery and persistence chain unrelated to calendar utilities. This is concrete malware behavior.
kordyn@0.9.18
This is concrete, unconsented persistence through import-time dropping of an embedded executable, unrelated to the stated package purpose.
kordyn@0.9.16
This is concrete hidden persistence behavior unrelated to the stated utility package and activates merely on import. Absence of an npm lifecycle hook does not mitigate the import-time dro...