Loading npm security reports…
Skip to main contentMalware2026-08-12 13:25Malware2026-08-12 13:25Malware2026-08-12 13:25Malware2026-08-12 13:25
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 378
Updated 19 Oct 2026, 15:47 UTC. Ordered by latest scan.
cvvkshuelwiu@1.0.0
OpenSSF/OSV malware advisory MAL-2026-13800 blocks this version. Package cvvkshuelwiu@1.0.0 contains 2 files with no a static rule matches and no traced behaviors of concern. No install-t...
nihzvdeowx5@1.0.0
OpenSSF/OSV malware advisory MAL-2026-13830 blocks this version. The package contains only index.html (declared as main in package.json) and no JavaScript entry point, lifecycle scripts,...
vczxijghsvizu4@1.0.0
OpenSSF/OSV malware advisory MAL-2026-13839 blocks this version. Package vczxijghsvizu4@1.0.0 contains 2 files with no a static rule matches and no traced behavior indicating exfiltration...
cvbniydplwe3@1.0.0
OpenSSF/OSV malware advisory MAL-2026-13797 blocks this version. The tarball contains only index.html (declared as package.json main) and no JavaScript, no lifecycle scripts, and no Node-...