Loading npm security reports…
Skip to main contentMalware2026-09-29 23:50Malware2026-09-29 23:50Data Exfiltration2026-09-29 23:47Malware2026-09-29 23:45
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 55
Updated 9 Oct 2026, 21:06 UTC. Ordered by latest scan.
common-fs@1.0.0
OpenSSF Malicious Packages via OSV confirms common-fs@1.0.0 as malicious (MAL-2026-17300): Malicious code in common-fs (npm)
tanksync@1.0.4
OpenSSF Malicious Packages via OSV confirms tanksync@1.0.4 as malicious (MAL-2026-17209): Malicious code in tanksync (npm)
omnirush@1.0.2
The package implements automatic, persistent transmission of user session and workspace data after ordinary CLI use. This is concrete unconsented data exfiltration behavior, despite the a...
test-agency-assignment-02@1.0.5
OpenSSF Malicious Packages via OSV confirms test-agency-assignment-02@1.0.5 as malicious (MAL-2026-17297): Malicious code in test-agency-assignment-02 (npm)
test-agency-assignment-01@1.0.5