Loading npm security reports…
Skip to main contentMalware2026-07-08 23:55Malware2026-07-08 23:55Malware2026-07-08 23:55Malware2026-07-08 23:55
npm threat feed
npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 426
Updated 21 Oct 2026, 14:19 UTC. Ordered by latest scan.
ulid-xyz@3.2.3
OpenSSF/OSV malware advisory MAL-2026-6672 blocks this version. ulid-xyz is a typosquat of the popular ulid library (sortable unique IDs) and is a cross-platform Remote Access Trojan deli...
loadutils@1.0.6
OpenSSF/OSV malware advisory MAL-2026-6580 blocks this version. Package `loadutils` is a typosquat of the widely-used webpack helper `loader-utils`. The shipped README documents the loade...
loadutils@1.0.5
OpenSSF/OSV malware advisory MAL-2026-6580 blocks this version. Package `loadutils` is a typosquat of the widely-used webpack helper `loader-utils`. The shipped README documents the loade...
loadutils@1.0.4
OpenSSF/OSV malware advisory MAL-2026-6580 blocks this version. Package `loadutils` is a typosquat of the widely-used webpack helper `loader-utils`. The shipped README documents the loade...