npm · disclosed 22 October 2026
Malware advisories against established npm packages
GitHub's malware feed flagged specific versions of several npm packages with real weekly downloads, including agentic-awesome-skills, opencode-skills-collection, @lumen-labs-dev/whisper-node, @factiii/runner and @tekmidian/pai. No public analysis of the payloads exists yet.
- Detectable by a website scanNo, server-side only
- Last reviewed23 October 2026
Affected packages
| Package | Affected versions |
|---|---|
agentic-awesome-skills | 18.9.0–19.13.0 (multiple) |
opencode-skills-collection | 4.0.56–4.1.20 (multiple) |
@lumen-labs-dev/whisper-node | 0.5.1 |
@factiii/runner | 0.28.0 |
@tekmidian/pai | 1.0.8, 1.0.9, 1.0.10 |
What to do
- Mostly developer tooling. Every audit checks the exact versions a site loads against these advisories automatically.
Sources
We update this page as new information is published. Package versions are also checked live against OSV.dev during every audit, so newly flagged versions are caught even before this page changes.