Loading npm security reports…
Skip to main contentMalware2026-09-18 16:30Malware2026-09-18 16:30Data Exfiltration2026-09-18 15:47Credential Exfiltration2026-09-18 15:19
npm threat feed
npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 78
Updated 11 Oct 2026, 16:27 UTC. Ordered by latest scan.
test8999-auth@1.0.1
OpenSSF Malicious Packages via OSV confirms test8999-auth@1.0.1 as malicious (MAL-2026-16286): Malicious code in test8999-auth (npm)
test899-auth@1.0.1
OpenSSF Malicious Packages via OSV confirms test899-auth@1.0.1 as malicious (MAL-2026-16285): Malicious code in test899-auth (npm)
sorrawit-dev-helper@1.0.0
The only shipped behavior is an automatic postinstall that reads /tmp/flag.txt and sends it to an attacker-controlled ngrok URL. That is unconsented install-time data theft, not a develop...
pf25133@1.0.0
The published main entrypoint is a default-on harvester that sends cookies and scraped application flags to a hardcoded webhook.site URL. That is concrete exfiltration, so the package is...