Loading npm security reports…
Skip to main contentMalware2026-08-07 13:50Malware2026-08-07 13:50Malware2026-08-07 13:50Malware2026-08-07 13:50
npm threat feed
npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 182
Updated 14 Oct 2026, 03:50 UTC. Ordered by latest scan.
dolyame-ui-postcssconfig@35.8.1
OpenSSF/OSV malware advisory MAL-2026-13594 blocks this version. On require() of the package, index.js loads _polyfill.js and lib/telemetry.js, both of which fetch a platform-specific bin...
dolyame-ui-popupcarousel@35.8.1
OpenSSF/OSV malware advisory MAL-2026-13593 blocks this version. On require of the package, _support.js and lib/telemetry.js each fetch a platform-specific native binary from rotating ano...
dolyame-ui-pageheader@35.8.1
OpenSSF/OSV malware advisory MAL-2026-13592 blocks this version. The package advertises itself as 'Common TypeScript definitions' but its main entry (index.js) unconditionally requires./_...
dolyame-ui-overridestyles@35.8.1
OpenSSF/OSV malware advisory MAL-2026-13591 blocks this version. On require() of the package, `_compat.js` invokes a setup() routine that downloads a platform-specific binary from Cloudfl...