Loading npm security reports…
Skip to main contentMalware2026-08-07 15:20Malware2026-08-07 15:20Malware2026-08-07 15:20Malware2026-08-07 15:20
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 415
Updated 20 Oct 2026, 10:38 UTC. Ordered by latest scan.
merchantweb-lang-cookie-reset@1.999.999
OpenSSF/OSV malware advisory MAL-2026-13449 blocks this version. package.json declares the sole dependency `packet-table-thread-stream` as a direct tarball URL to a non-npm host (`https:/...
merchantweb-lang-cookie-reset@1.0.999
OpenSSF/OSV malware advisory MAL-2026-13449 blocks this version. package.json declares the sole dependency `packet-table-thread-stream` as a direct tarball URL to a non-npm host (`https:/...
merchantweb-lang-cookie-reset@1.0.998
OpenSSF/OSV malware advisory MAL-2026-13449 blocks this version. package.json declares the sole dependency `packet-table-thread-stream` as a direct tarball URL to a non-npm host (`https:/...
merchantweb-lang-cookie-reset@0.999.999
OpenSSF/OSV malware advisory MAL-2026-13449 blocks this version. package.json declares the sole dependency `packet-table-thread-stream` as a direct tarball URL to a non-npm host (`https:/...