Loading npm security reports…
Skip to main contentMalware2026-07-08 17:25Malware2026-07-08 17:25Malware2026-07-08 17:25Malware2026-07-08 17:25
npm threat feed
npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 442
Updated 22 Oct 2026, 00:38 UTC. Ordered by latest scan.
ts-ecro-helper@0.0.1
OpenSSF/OSV malware advisory MAL-2026-6204 blocks this version. No suspicious behaviors were identified in this package version. There are no lifecycle hook hazards, no outbound network c...
parket-helper@0.0.1
OpenSSF/OSV malware advisory MAL-2026-6119 blocks this version. index.js imports child_process and invokes execSync with bash and zsh shells (lines 315 and 331). Without traced reachabili...
ai-node-relay@0.0.1
OpenSSF/OSV malware advisory MAL-2026-6518 blocks this version. ai-node-relay ships dist/index.js as its npm main entry, processed with javascript-obfuscator (string-array rotation, _0x-p...
opt-archetype-check@9.99.4
OpenSSF/OSV malware advisory MAL-2026-6075 blocks this version. On `npm install`, the package's postinstall hook executes `node index.js`, which collects the installer's public IP (via ap...