Loading npm security reports…
Skip to main contentMalware2026-09-25 14:35Malware2026-09-25 14:35Data Exfiltration2026-09-25 08:49Data Exfiltration2026-09-25 08:49
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 70
Updated 10 Oct 2026, 08:12 UTC. Ordered by latest scan.
shoplist-app@993.99.99
OpenSSF Malicious Packages via OSV confirms shoplist-app@993.99.99 as malicious (MAL-2026-17185): Malicious code in shoplist-app (npm)
shoplist-app@99.99.99
OpenSSF Malicious Packages via OSV confirms shoplist-app@99.99.99 as malicious (MAL-2026-17185): Malicious code in shoplist-app (npm)
com.apple.unityplugin.storekit@1.0.1
The sole entrypoint sends machine identity to an unrelated oast.fun callback and contains no StoreKit functionality. That is concrete data exfiltration even though a variable typo and mod...
com.apple.unityplugin.storekit@1.0.2
The package's only runtime behavior is an automatic request that sends the machine hostname and OS platform to an unrelated oast.fun callback. That is concrete import-time data exfiltrati...