npm threat feed

npm advisory reports, with evidence.

Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.

Security reports — page 40

Updated 9 Oct 2026, 11:47 UTC. Ordered by latest scan.

@hrmony/pladddform-application@2.99.0

This is active, import-triggered secret harvesting and exfiltration to an unrelated fixed endpoint. The behavior is concrete and requires blocking publication.

Credential Exfiltration2026-09-29 16:17

dotenv-preflight@1.0.0

This is concrete automatic credential harvesting and data exfiltration during installation, concealed by heavy obfuscation. It is unrelated to a legitimate dotenv preflight check.

Credential Exfiltration2026-09-29 15:25

items-validator@1.0.5

The import-time daemon and remote Function execution form an active remote-code-execution path. The cryptographic check authenticates the operator payload rather than constraining its cap...

Remote Code Execution2026-09-29 08:10

mini-hardhat@1.1.4

OpenSSF Malicious Packages via OSV confirms mini-hardhat@1.1.4 as malicious (MAL-2026-17236): Malicious code in mini-hardhat (npm)

Malware