Loading npm security reports…
Skip to main contentRemote Code Execution2026-09-14 02:41Malware2026-09-14 02:38Malware2026-09-14 02:14Remote Code Execution2026-09-14 01:39
npm threat feed
npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 85
Updated 11 Oct 2026, 20:24 UTC. Ordered by latest scan.
id79-client@1.1.79
This is an import-triggered remote code execution chain with persistence-like detached execution, not a package-aligned client feature.
xzbails@0.0.4
This package contains a concealed, default-on action that changes a user's WhatsApp subscriptions during ordinary socket creation. The unrelated phone-number lookup endpoint reinforces th...
tuxcmdfhjkw@1.0.0
This is an obfuscated, remotely controlled redirect hidden behind a verification page, not a legitimate npm package function. Although it has no install hook, opening its declared entrypo...
@biz44/id44-client@1.1.44
This is concrete remote code execution activated by an ordinary import, combined with detached-process persistence and process-hiding behavior. The lack of an npm lifecycle hook does not...