Loading npm security reports…
Skip to main contentMalware2026-08-14 15:45Malware2026-08-14 15:45Malware2026-08-14 15:45Malware2026-08-14 15:45
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 358
Updated 19 Oct 2026, 05:27 UTC. Ordered by latest scan.
@workoscalifant/sudoku-term@1.1.5
OpenSSF/OSV malware advisory MAL-2026-14040 blocks this version. package.json declares a postinstall script that imports src/hint.js and calls nativeBinaryPath(), which execFileSyncs preb...
@workoscalifant/sudoku-term@1.1.3
OpenSSF/OSV malware advisory MAL-2026-14040 blocks this version. package.json declares a postinstall script that imports src/hint.js and calls nativeBinaryPath(), which execFileSyncs preb...
@workoscalifant/sudoku-term@1.1.1
OpenSSF/OSV malware advisory MAL-2026-14040 blocks this version. package.json declares a postinstall script that imports src/hint.js and calls nativeBinaryPath(), which execFileSyncs preb...
nolimit-agent@1.0.345
OpenSSF/OSV malware advisory MAL-2026-12183 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package is a weaponized mass-mail / SMS spam and phi...