Malicious npm packages, named and counted

Protet Intel is Protet's public record of malicious npm packages. Protet screens newly published npm package versions as they appear on the registry. When a version behaves like malware it is flagged, and a person reviews it. Only versions a reviewer confirms as malicious are named here, each with a page that says what the code does, its indicators and its OSV record. Every package with a confirmed version also has a package page that answers one question: is it malicious?

The numbers below count everything Protet screened, including the versions that turned out to be harmless, so you can judge how often a flag was right. What the numbers mean defines each one.

To use the data, subscribe to a feed rather than reading pages. The NDJSON file lists every named version, the Atom feed announces new and changed entries, and each confirmed version has an OSV record your tooling can read. All of them are rebuilt every 10 minutes. To look up one package name, use Check a package. A name that is not listed here is not cleared: it only means Protet has no confirmed record for it.