Loading npm security reports…
Skip to main contentRemote Code Execution2026-07-01 05:07Remote Code Execution2026-07-01 00:50Remote Code Execution2026-07-01 00:18
npm threat feed
npm remote execution reports, with evidence.
Investigate remote code execution and remote payload execution, including code fetched or launched by a package. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 33
Updated 9 Oct 2026, 07:50 UTC. Ordered by latest scan.
chai-as-staged@6.0.4
Source inspection confirms a user-invoked staged payload loader with network retrieval and dynamic execution, which is concrete malicious behavior. The absence of install hooks lowers tri...
db-convertor@1.0.5
Static source inspection confirms a concealed, package-misaligned remote code execution path in index.js. Absence of lifecycle execution lowers trigger breadth but does not make the expos...
db-connector-log@1.0.1
Direct source inspection confirms a hidden, package-misaligned remote payload execution path in index.js. Although not install-time, the exported runtime method is concrete malicious beha...
buffer-util-internal@1.0.14
Static source inspection confirms concrete import-time remote code execution in index.js, not merely a scanner hint. This is unconsented executable payload loading unrelated to the stated...