Loading npm security reports…
Skip to main contentMalware2026-08-07 00:35Malware2026-08-07 00:35Malware2026-08-07 00:35Malware2026-08-07 00:35
npm threat feed
npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 189
Updated 14 Oct 2026, 08:06 UTC. Ordered by latest scan.
santana-baileys@2.0.2
OpenSSF/OSV malware advisory MAL-2026-13456 blocks this version. santana-baileys is a fork of the Baileys WhatsApp library. lib/Socket/messages-send.js line 425 (and again at line 436) re...
squeez@1.40.0
OpenSSF/OSV malware advisory MAL-2026-13458 blocks this version. squeez@1.38.0 declares a postinstall hook ("postinstall": "node install.js") that runs automatically on npm install. insta...
vite-plugin-cleaner@4.1.3
OpenSSF/OSV malware advisory MAL-2026-13463 blocks this version. package.json declares an optionalDependency `vite-cleaning-tools` pointing at `github:vite-plugins/vite-cleaning-tools` wi...
remote-claude-daemon@0.6.6
OpenSSF/OSV malware advisory MAL-2026-13455 blocks this version. remote-claude-daemon connects to a hardcoded WebSocket relay at wss://remote-claude-relay.fly.dev and treats inbound messa...