Loading npm security reports…
Skip to main contentMalware2026-09-30 02:35Malware2026-09-30 01:50Malware2026-09-30 01:50Malware2026-09-30 01:50
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 51
Updated 9 Oct 2026, 18:21 UTC. Ordered by latest scan.
epic-service-client@1.0.0
OpenSSF Malicious Packages via OSV confirms epic-service-client@1.0.0 as malicious (MAL-2025-49190): Malicious code in epic-service-client (npm)
fabric-loader-core@1.0.0
OpenSSF Malicious Packages via OSV confirms fabric-loader-core@1.0.0 as malicious (MAL-2026-17306): Malicious code in fabric-loader-core (npm)
tailwind-forms-kit@0.5.1
OpenSSF Malicious Packages via OSV confirms tailwind-forms-kit@0.5.1 as malicious (MAL-2026-17310): Malicious code in tailwind-forms-kit (npm)
fabric-mod-utils@1.0.0
OpenSSF Malicious Packages via OSV confirms fabric-mod-utils@1.0.0 as malicious (MAL-2026-17307): Malicious code in fabric-mod-utils (npm)
mfahelper@1.0.0
OpenSSF Malicious Packages via OSV confirms mfahelper@1.0.0 as malicious (MAL-2026-17308): Malicious code in mfahelper (npm)