Malicious npm packages named by Protet Intel

This page lists every npm package and version that Protet Intel names. A package is listed when a reviewer confirmed at least one of its versions as malicious after Protet flagged it during screening. Each package links to a page with the affected versions, what the code does when it is installed, its indicators, and what to do if you installed it. Each version links to its own record.

Two other states appear in the list. Withdrawn means a reviewer later changed the verdict; the entry stays public with the date of the change. BTP, short for legitimate-publisher, marks behaviour that matches malware patterns from a publisher we assess as legitimate, for example security tooling. BTP entries are not malware and are never reported to OSV.

For automation, use the npm feeds: NDJSON for the full list and Atom for updates, or the OSV record linked from each confirmed version. To look up one name, use Check a package. A package missing from this list is not cleared. How Protet Intel counts.