Loading npm security reports…
Skip to main contentMalware2026-09-11 09:17Malware2026-09-11 09:16Malware2026-09-11 09:16Data Exfiltration2026-09-11 07:19
npm threat feed
npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 88
Updated 11 Oct 2026, 22:18 UTC. Ordered by latest scan.
levvleys@2.0.18
The package embeds a remote-controlled, automatic account-subscription action in its standard runtime connection path. Its benign lifecycle version check does not mitigate that concrete b...
levvleys@2.0.19
The package contains concealed, automatic account manipulation and a remotely controlled target list. This is concrete malicious runtime behavior, not package-aligned setup.
levvleys@2.0.17
The runtime socket contains a concrete, remotely controlled, unconsented action on the consumer's authenticated WhatsApp account. The benign Node-version preinstall check does not mitigat...
strapi-plugin-vinsoc-1109@3.6.8
This is concrete unconsented install-time host data exfiltration to an external endpoint. The lifecycle trigger and callback are directly established by source inspection.