Loading npm security reports…
Skip to main contentMalware2026-09-09 03:10Malware2026-09-09 02:30Malware2026-09-09 02:30Malware2026-09-09 02:30
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 186
Updated 13 Oct 2026, 04:31 UTC. Ordered by latest scan.
dbt-language-server@1.0.2
OpenSSF/OSV malware advisory MAL-2026-6367 blocks this version. package.json declares a preinstall hook (`node index.js`) that runs automatically on `npm install`. index.js collects insta...
bx-ui-view@1.0.0
OpenSSF/OSV malware advisory MAL-2026-16064 blocks this version. package.json declares a dependency whose key equals the package's own name (bx-ui-view) and whose value is a plain HTTPS U...
punypump@1.2.2
OpenSSF/OSV malware advisory MAL-2026-16048 blocks this version. The package presents itself as a console shim (index.js is a verbatim copy of console-browserify with description 'Emulate...
express-session-timer@1.0.16
OpenSSF/OSV malware advisory MAL-2026-16065 blocks this version. express-session-timer@1.0.1 schedules an unconditional destructive routine at module load time. Approximately 18 seconds a...
