Loading npm security reports…
Skip to main contentMalware2026-08-11 13:00Malware2026-08-11 13:00Malware2026-08-11 13:00Malware2026-08-11 13:00
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 387
Updated 19 Oct 2026, 19:48 UTC. Ordered by latest scan.
@sqlite-labs/createsql@1.0.5
OpenSSF/OSV malware advisory MAL-2026-13713 blocks this version. The package's main entry (index.js) fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket (https://bdmka...
@sqlite-labs/createsql@1.0.4
OpenSSF/OSV malware advisory MAL-2026-13713 blocks this version. The package's main entry (index.js) fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket (https://bdmka...
@sqlite-labs/createsql@1.0.3
OpenSSF/OSV malware advisory MAL-2026-13713 blocks this version. The package's main entry (index.js) fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket (https://bdmka...
@sqlite-labs/createsql@1.0.2
OpenSSF/OSV malware advisory MAL-2026-13713 blocks this version. The package's main entry (index.js) fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket (https://bdmka...
