Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-27 07:05Credential Exfiltration2026-09-27 03:20Remote Code Execution2026-09-26 16:52
npm threat feed
npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 42
Updated 9 Oct 2026, 13:10 UTC. Ordered by latest scan.
@rutxploit-sec/subsplash-canny@1.0.0
This package contains an active preinstall payload intended to run when a dependency-confusion target installs it. The automatic collection and network action make this a blockable instal...
my-skibidi@1.0.3
The active entrypoint implements unsolicited browser credential and data collection followed by transmission to an unrelated external endpoint. This is concrete credential and data exfilt...
hardhat-zet@2.0.1
Importing the package runs an obfuscated loader that shells out through execSync and prepares host and username collection plus an axios send. That is concrete remote command execution hi...
img-to-native@1.0.1
Import of the published entrypoint is a dropper: it decrypts a concealed payload with a hardcoded key and writes an executable while deleting the staging file. The image-conversion API do...