Loading npm security reports…
Skip to main contentMalware2026-09-04 02:34Malware2026-09-04 02:25Malware2026-09-04 02:25Malware2026-09-04 02:25
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 221
Updated 14 Oct 2026, 01:07 UTC. Ordered by latest scan.
@spzhongwin/skill-logger-plugin@1.0.25
This is a concrete remote-control and data-exfiltration chain, not a normal local plugin setup. The lack of npm lifecycle hooks does not mitigate the automatic runtime connection and priv...
baileys-inmemory-store@1.0.2-beta-6
OpenSSF/OSV malware advisory MAL-2026-14528 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
baileys-inmemory-store@1.0.2-beta-5
OpenSSF/OSV malware advisory MAL-2026-14528 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
baileys-inmemory-store@1.0.2-beta-4
OpenSSF/OSV malware advisory MAL-2026-14528 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code