npm install actual-malware

In plain words

This project is a demonstration of vulnerabilities in package registry ecosystems like npm. Created in 2022, it illustrates how malware can be distributed through package managers, highlighting security risks that developers should be aware of. The project serves as an educational tool for the development community to understand threats in their dependency management workflows and encourage better security practices across package registry platforms.

written from the facts on this page · September 2026

From the sources

Just npm install. Contribute to qpwo/actual-malware development by creating an account on GitHub.

• 
  Tips to stay safe from NPM supply chain attacks2025 · github.com · ▲96

  Hi everyone, given the recent increase of attacks on the NPM supply chain, I've put together a list of tips and tricks to help developers stay secure on this specific topic: https://github.com/bodadotsh/npm-security-best-practices I'd love for you to check it out, and contribute your own insights and best practices to make this a comprehensive resource for the community. Cheers!

• 
  Safe-NPM – only install packages that are +90 days oldNov 2025 · github.com · ▲90

  This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…

• AI
  Auto install npm dependencies as you code2016 · npmjs.com · ▲60
• 
  DepsGuardMay 2026 · depsguard.com · ▲10

  Configure once, prevent the next compromised package install

• 
  Safe-install – safer NPM installs with trusted build dependenciesMay 2026 · npmjs.com · ▲19

  In light of the ongoing npm supply chain compromises, I built safe-install: https://www.npmjs.com/package/@gkiely/safe-install It brings a couple of protections I wanted from npm but are not built in. Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts: https://bun.com/docs/guides/install/trusted It also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:…

• 
  NPMScan2025 · npmscan.com · ▲1

  Malicious npm package detection & security scanner

• 
  /dev/null▲481

  a social network for devs

  Dev tools · 2d ago · dev-null.sh

• 
  Whiteboard (YC W26) – an open-source IDE for thoughtful software design▲423

  open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.

  Dev tools · 27d ago · github.com

• 
  Reladraw – A diagram language where you decide where to place things▲411

  Contribute to reladraw/reladraw development by creating an account on GitHub.

  Dev tools · 25d ago · github.com

• 
  OpenBot▲362

  Grok Bot alternative: free, local, open-source, multiplayer

  Dev tools · 22d ago · openbot.run

• 
  Talanoa▲341

  Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…

  Dev tools · 20d ago · talanoa.email

• 
  CoreSpeed▲332

  One MCP for everything your agents need: apps, memory, tools

  Dev tools · 27d ago · corespeed.io

• IM
  I made a web game called Almost Pong▲1,135

  Hi HN! I made many small web games in the past with Unity or Phaser. But this time I wanted to make something completely on my own. So I coded a basic game framework in plain JavaScript, and used it to make Almost Pong. This was a really fun project that taught me a lot about JavaScript, and I plan to make more minimalist games with this framework. Interesting fact: Almost Pong doesn't load any assets, all sprites and sounds are generated with code. Happy to answer questions, and please let me know if you have any feedback on the game. Thanks!

  Dev tools · 2022 · lessmilk.com

• IM
  I'm writing a free book called Computer Networks from Scratch▲792

  Life & fun · 2022 · networksfromscratch.com

• HA
  HN Avatars in 357 bytes▲701

  Paste the following into the console of any HN page - for annotated avatars on all HN comments. (self contained code) for(u of document.querySelectorAll('.hnuser'))for(u.prepend(c=document.createElement('canvas')),x=c.getContext('2d'),c.width=18,c.height=14,s=u.innerText,r=1,i=28+s.length;i--;i>>29>X*X/3+Y/2&&x.fillRect(6+2*X,2*Y,2,2)&x.fillRect(6-2*X,2*Y,2,2):r+=s.charCodeAt(i-28,x.fillStyle='#'+(r>>8&0xFFFFFF).toString(16)))r^=r>>17,r^=r>2

  Dev tools · 2022

• 
  Tome Beta▲697

  The storytelling tool for work

  Work · 2022 · tome.app

• 
  Kairn▲694

  Regain control over your days

  Dev tools · 2022

• 
  A game that tests how well you know your local area▲654

  How well do you know your area? Test your knowledge by locating streets on a map.

  Work · 2022 · backofyourhand.com