Loading npm security reports…
Skip to main contentMalware2026-09-04 06:55Malware2026-09-04 06:55Malware2026-09-04 06:55Malware2026-09-04 06:55
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 216
Updated 13 Oct 2026, 22:21 UTC. Ordered by latest scan.
h3client@1.0.0
OpenSSF/OSV malware advisory MAL-2026-15585 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
h3-codex@1.0.1
OpenSSF/OSV malware advisory MAL-2026-15584 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
h3-codex@1.0.0
OpenSSF/OSV malware advisory MAL-2026-15584 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
kisama-js@0.3.5
OpenSSF/OSV malware advisory MAL-2026-15645 blocks this version. kisama-js@0.4.8 ships an obfuscated index.js that runs an HTTP+WebSocket agent binding 0.0.0.0:8000 by default and exposin...
kisama-js
