npm threat feed

npm security reports, with evidence.

Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.

Security reports — page 605

Updated 26 Oct 2026, 07:55 UTC. Ordered by latest scan.

pob-test-package-in-monorepo@5.2.1

OpenSSF/OSV malware advisory MAL-2026-11980 blocks this version. npm/pob-test-package-in-monorepo is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...

Malware2026-08-05 00:55

file-entry-cache@11.1.6

OpenSSF/OSV malware advisory MAL-2026-11970 blocks this version. npm/file-entry-cache version 11.1.6 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHu...

Malware2026-08-05 00:55

cacheable-request@13.0.20

OpenSSF/OSV malware advisory MAL-2026-11964 blocks this version. npm/cacheable-request version 13.0.20 is a trojanized release published on 2026-08-04 during the compromise of the npm/Git...

Malware2026-08-05 00:55

flat-cache@6.1.24

OpenSSF/OSV malware advisory MAL-2026-11971 blocks this version. npm/flat-cache version 6.1.24 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub main...

Malware2026-08-05 00:55

cacheable@2.5.1

OpenSSF/OSV malware advisory MAL-2026-11963 blocks this version. npm/cacheable version 2.5.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub mainta...

Malware2026-08-05 00:55

sextant-cli-darwin-arm64@0.0.1-rc24

OpenSSF/OSV malware advisory MAL-2026-11997 blocks this version. Package ships a darwin/arm64 Go binary that opens an outbound WebSocket to a hardcoded author-controlled relay at wss://re...

Malware2026-08-05 00:55

simple-date-formatter-util-7@1.0.0

OpenSSF/OSV malware advisory MAL-2026-11998 blocks this version. Package advertises itself as a date formatter utility but ships a malicious postinstall payload. package.json declares a p...

Malware2026-08-05 00:55

streak-math-metrics@1.0.0

OpenSSF/OSV malware advisory MAL-2026-12000 blocks this version. The package's module entry dist/index.mjs runs a top-level IIFE on import that chmods dist/math-calc.bin to 0755 and spawn...

Malware2026-08-05 00:55

streak-test-mathcore@1.0.0

OpenSSF/OSV malware advisory MAL-2026-12003 blocks this version. Package main dist/index.mjs runs a top-level IIFE that spawns dist/math-core.bin via child_process.spawn on any import of...

Malware2026-08-05 00:55

streak-metricazbd@1.0.0

OpenSSF/OSV malware advisory MAL-2026-12001 blocks this version. On import of the package, dist/index.mjs runs an IIFE that copies a bundled Linux x86_64 ELF (dist/math-core.bin) to /tmp/...

Malware2026-08-05 00:55

streak-metricsazb@1.0.0

OpenSSF/OSV malware advisory MAL-2026-12002 blocks this version. On import of the package's main entry, a top-level async IIFE in index.mjs (labelled 'ENGINE INITIALIZATION & CALIBRATION'...

Malware2026-08-05 00:55

streak-map-metrics@1.0.0

OpenSSF/OSV malware advisory MAL-2026-11999 blocks this version. The package's main module dist/index.mjs, executed on any import or require of the package, concatenates an array of base6...

Malware2026-08-05 00:55

create-cf-token@1.1.4

OpenSSF/OSV malware advisory MAL-2026-5240 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

Malware2026-08-05 00:55

discord-search@0.1.3

OpenSSF/OSV malware advisory MAL-2026-5244 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

Malware2026-08-05 00:55

dbmux@1.0.6

OpenSSF/OSV malware advisory MAL-2026-5243 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

Malware2026-08-05 00:55

@servicetitan/titan-chat-ui-anvil2@9.0.7