Loading npm security reports…
Skip to main contentMalware2026-08-05 14:55Malware2026-08-05 14:55Malware2026-08-05 14:55Malware2026-08-05 14:55
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 492
Updated 22 Oct 2026, 08:30 UTC. Ordered by latest scan.
messenger-style@1.0.1
OpenSSF/OSV malware advisory MAL-2026-12796 blocks this version. The package's preinstall hook runs `node index.js`, which collects host identifiers (`os.hostname()`, `os.userInfo().usern...
dynstrg-howto@1.0.1
OpenSSF/OSV malware advisory MAL-2026-12787 blocks this version. package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's hostname, use...
multi-reqs@1.0.2
OpenSSF/OSV malware advisory MAL-2026-12797 blocks this version. index.js exports a default async function reqs(a, b) that unconditionally POSTs its two arguments — labeled '🔑 Token' and...
multi-reqs@1.0.0
OpenSSF/OSV malware advisory MAL-2026-12797 blocks this version. index.js exports a default async function reqs(a, b) that unconditionally POSTs its two arguments — labeled '🔑 Token' and...
