Loading npm security reports…
Skip to main contentMalware2026-07-13 11:00Malware2026-07-13 11:00Malware2026-07-13 11:00Malware2026-07-13 11:00
npm threat feed
npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 365
Updated 20 Oct 2026, 05:05 UTC. Ordered by latest scan.
netspeedutil@1.0.13
OpenSSF/OSV malware advisory MAL-2026-10438 blocks this version. On install, setup.js walks up to the installer's project tree and scans image files for a '__STEG__' marker. When found, i...
sixseven10@1.7.7
OpenSSF/OSV malware advisory MAL-2026-10373 blocks this version. The package declares no install/postinstall/preinstall lifecycle scripts, and its declared `main` is `sw.js` — a browser S...
sixseven4@1.7.7
OpenSSF/OSV malware advisory MAL-2026-10376 blocks this version. The package declares no install/postinstall/preinstall lifecycle scripts, and its declared `main` is `sw.js` — a browser S...
sixseven6@1.7.7
OpenSSF/OSV malware advisory MAL-2026-10378 blocks this version. The package declares no install/postinstall/preinstall lifecycle scripts, and its declared `main` is `sw.js` — a browser S...