Loading npm security reports…
Skip to main contentMalware2026-08-05 14:00Malware2026-08-05 14:00Malware2026-08-05 14:00Malware2026-08-05 14:00
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 496
Updated 22 Oct 2026, 10:45 UTC. Ordered by latest scan.
tt-help-cli-ycl@1.4.59
OpenSSF/OSV malware advisory MAL-2026-12488 blocks this version. The package's `tt-help watchdog` subcommand starts a long-running agent that POSTs heartbeats to a remote server (default...
simplipayng@1.0.8
OpenSSF/OSV malware advisory MAL-2026-12437 blocks this version. dist/cjs/index.js appends an eval(atob(...)) blob to what appears to be a React Button re-export. The decoded payload quer...
sextant-cli-darwin-amd64@0.0.1-rc35
OpenSSF/OSV malware advisory MAL-2026-12028 blocks this version. The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main,...
sextant-cli-darwin-amd64@0.0.1-rc33
OpenSSF/OSV malware advisory MAL-2026-12028 blocks this version. The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main,...