Loading npm security reports…
Skip to main contentMalware2026-07-16 19:45Malware2026-07-16 19:45Malware2026-07-16 19:45Malware2026-07-16 19:45
npm threat feed
npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 343
Updated 18 Oct 2026, 16:34 UTC. Ordered by latest scan.
nordpass@1.0.0
OpenSSF/OSV malware advisory MAL-2026-10743 blocks this version. Package name impersonates the NordPass password-manager product while presenting itself as 'A simple authentication module...
node-as-api@2.1.6
OpenSSF/OSV malware advisory MAL-2026-10742 blocks this version. On npm install, package.json's postinstall hook runs `node test.js`, which loads index.js and immediately invokes two harv...
channel-worker@2.5.39
OpenSSF/OSV malware advisory MAL-2026-10729 blocks this version. The package's runtime code implements a remote command-and-control agent rather than a normal library. bin/cli.js hardcode...
netcontrol-agent@1.0.5
OpenSSF/OSV malware advisory MAL-2026-10741 blocks this version. netcontrol-agent.js implements a remote agent that long-polls a configured server URL and pipes the returned bytes directl...