Loading npm security reports…
Skip to main contentMalware2026-08-06 14:45Malware2026-08-06 14:45Malware2026-08-06 14:30Malware2026-08-06 14:30
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 439
Updated 20 Oct 2026, 23:00 UTC. Ordered by latest scan.
@activepieces/piece-google-forms@0.5.6
OpenSSF/OSV malware advisory MAL-2026-13396 blocks this version. The published tarball for @activepieces/piece-google-forms 0.5.7 contains src/index.js which imports child_process, invoke...
@activepieces/piece-google-forms@0.5.5
OpenSSF/OSV malware advisory MAL-2026-13396 blocks this version. The published tarball for @activepieces/piece-google-forms 0.5.7 contains src/index.js which imports child_process, invoke...
@innocarpe/deepseek-build@1.0.0
OpenSSF/OSV malware advisory MAL-2026-13420 blocks this version. The npm package's postinstall script (scripts/postinstall.js) requires child_process and issues POST requests carrying env...
@trackunit/iris-app-sdk-vite@1.2.10-alpha-d785aff3531.0
OpenSSF/OSV malware advisory MAL-2026-13421 blocks this version. This version of @trackunit/iris-app-sdk-vite declares `cross-keychain: ^1.1.0` in its package.json dependencies. cross-key...