Loading npm security reports…
Skip to main contentMalware2026-09-30 05:50Malware2026-09-30 05:50Malware2026-09-30 05:50Malware2026-09-30 05:20
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 46
Updated 9 Oct 2026, 14:41 UTC. Ordered by latest scan.
express-session-timer@1.0.15
OpenSSF Malicious Packages via OSV confirms express-session-timer@1.0.15 as malicious (MAL-2026-16065): Malicious code in express-session-timer (npm)
express-session-timer@1.0.11
OpenSSF Malicious Packages via OSV confirms express-session-timer@1.0.11 as malicious (MAL-2026-16065): Malicious code in express-session-timer (npm)
focaleys@1.1.0
OpenSSF Malicious Packages via OSV confirms focaleys@1.1.0 as malicious (MAL-2026-17329): Malicious code in focaleys (npm)
epic-ue-loading@0.0.1-security
OpenSSF Malicious Packages via OSV confirms epic-ue-loading@0.0.1-security as malicious (MAL-2022-2771): Malicious code in epic-ue-loading (npm)
epic-ue-loading@0.2.0