On npm, open the package page and use the Report malware button. On PyPI, sign in, open the project and use Report project as malware in the sidebar. Include the package name, affected versions and evidence. Vulnerabilities are different: send those privately to maintainers.
Malware report or vulnerability report?
| Situation | Where it goes |
|---|---|
| The package is built to do harm (credential theft, backdoor, typosquat) | The registry's malware report |
| A legitimate package has a security flaw | The maintainers, privately |
| A flaw in the registry itself | The registry's security contact |
npm's documentation says vulnerabilities in npm packages should be reported directly to the package maintainers, and that you can find contacts with npm owner ls.
Reporting on npm
The documented steps:
- Gather the package name and all affected versions.
- Open the package page and choose Report malware.
- Enter your name, a contact email, the package name and versions, and describe what the malware does.
- Include references, commits or code examples that would help researchers confirm it.
- Send the report.
npm says its security team confirms the report, removes the package, publishes a security placeholder and issues an advisory.
Reporting on PyPI
The PyPI security page describes this path:
- Log in and go to the project page.
- Click Report project as malware at the bottom of the sidebar.
- Give the project URL, an explanation of why it is a security issue, and a link to the problematic lines in its distributions through inspector.pypi.io.
The page lists typo-squatting, dependency confusion, data exfiltration, obfuscation and command and control among the valid reasons. For security issues in PyPI itself, it asks you to email security@pypi.org and not to report publicly. It says to expect acknowledgment within 48 hours.
PyPI's acceptable use policy also bars using PyPI to deliver malicious executables or act as attack infrastructure.
Other registries
Check each registry's own security or policies page for the current reporting route. We did not confirm a process for every registry, so look up the right one before you write the report.
What makes a report useful
- Exact name and versions, with the publish time.
- The specific file and lines that do the harm.
- What it does, for example which data it reads and where it sends it.
- Do not run it again to demonstrate it. Static evidence is enough.
While you wait, remove it from your own projects. See what to do after installing a malicious package.
Quick check
Should I post about it publicly first?
Report privately first so the registry can act quickly. A public post can help others but should follow, not replace, the report.
What if the package is vulnerable but not malicious?
Contact the maintainers privately. That is the route npm's documentation gives for vulnerabilities.
Safeguard does SBOM and dependency scanning, and a free scan lists the packages you may want to check first.
Sources
Last reviewed: 19 October 2026.
