Loading npm security reports…
Skip to main contentMalware2026-08-07 00:35Malware2026-08-07 00:35Malware2026-08-07 00:35Malware2026-08-07 00:35
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 425
Updated 20 Oct 2026, 15:28 UTC. Ordered by latest scan.
trimprompt@1.0.47
OpenSSF/OSV malware advisory MAL-2026-13462 blocks this version. The package `trimprompt@1.0.47` ships a large set of heavily obfuscated JavaScript modules (hex-mangled identifiers `_0x.....
trimprompt@1.0.46
OpenSSF/OSV malware advisory MAL-2026-13462 blocks this version. The package `trimprompt@1.0.47` ships a large set of heavily obfuscated JavaScript modules (hex-mangled identifiers `_0x.....
trimprompt@1.0.42
OpenSSF/OSV malware advisory MAL-2026-13462 blocks this version. The package `trimprompt@1.0.47` ships a large set of heavily obfuscated JavaScript modules (hex-mangled identifiers `_0x.....
electrode-ota-ui-app@99.0.1
OpenSSF/OSV malware advisory MAL-2026-12368 blocks this version. Package targets the electrode-io internal name `electrode-ota-ui-app` with an inflated 99.0.1 version to win dependency re...