Loading npm security reports…
Skip to main contentMalware2026-07-13 07:55Malware2026-07-13 07:55Malware2026-07-13 07:55Malware2026-07-13 07:55
npm threat feed
npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 376
Updated 20 Oct 2026, 10:18 UTC. Ordered by latest scan.
bs58-86@6.0.2
OpenSSF/OSV malware advisory MAL-2026-6448 blocks this version. Package `bs58-86@6.0.1` reproduces the name, README, repository URL (`cryptocoinjs/bs58`), and exported API of the widely-u...
tokenization-util@0.1.0
OpenSSF/OSV malware advisory MAL-2026-6440 blocks this version. The package advertises plain math/formatter helpers but index.js contains a heavily obfuscated payload concealed inside the...
@torbeck/heap@4.3.11
OpenSSF/OSV malware advisory MAL-2026-10405 blocks this version. @torbeck/heap impersonates the legitimate @datastructures-js/heap package: README.md line 1 reads `# @datastructures-js/he...
@torbeck/heap@4.3.10
OpenSSF/OSV malware advisory MAL-2026-10405 blocks this version. @torbeck/heap impersonates the legitimate @datastructures-js/heap package: README.md line 1 reads `# @datastructures-js/he...