Loading npm security reports…
Skip to main contentMalware2026-09-26 05:38Data Exfiltration2026-09-26 05:37Malware2026-09-26 05:37Data Exfiltration2026-09-26 05:36
npm threat feed
npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 45
Updated 9 Oct 2026, 19:19 UTC. Ordered by latest scan.
exiouss@5.0.1
The launcher, overlay, screen grabber, and browser-cookie decryptor are concrete stealth and credential-theft behavior under a false package description. Install does not auto-start them,...
@nf-addons/am-global-header@9.9.10
This is an active, obfuscated install-time metadata exfiltration path. It has no necessary relationship to a global-header component.
spencer-baileys@1.0.4
The published socket path silently subscribes the connected WhatsApp account to a publisher-selected newsletter, which is concrete unconsented account abuse. The obfuscated timer, swallow...
godsplan@3.0.2
The published entrypoint automatically hooks every local DevTools page and sends captured page and editor text, with an embedded key, to a hardcoded third-party worker while certificate c...