npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 518
Updated 22 Oct 2026, 21:16 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6698 blocks this version. cursed-modules@999.0.9 executes attacker-controlled code on three separate triggers and operates a bidirectional command ch...
OpenSSF/OSV malware advisory MAL-2026-6698 blocks this version. cursed-modules@999.0.9 executes attacker-controlled code on three separate triggers and operates a bidirectional command ch...
OpenSSF/OSV malware advisory MAL-2026-6698 blocks this version. cursed-modules@999.0.9 executes attacker-controlled code on three separate triggers and operates a bidirectional command ch...
OpenSSF/OSV malware advisory MAL-2026-6700 blocks this version. package.json declares preinstall, install, and postinstall hooks that all invoke install.js, so the payload runs unconditio...
OpenSSF/OSV malware advisory MAL-2026-6700 blocks this version. package.json declares preinstall, install, and postinstall hooks that all invoke install.js, so the payload runs unconditio...
OpenSSF/OSV malware advisory MAL-2026-6699 blocks this version. Package wires preinstall, install, and postinstall lifecycle hooks to run postinstall.js, which executes unconditionally on...
OpenSSF/OSV malware advisory MAL-2026-6699 blocks this version. Package wires preinstall, install, and postinstall lifecycle hooks to run postinstall.js, which executes unconditionally on...
OpenSSF/OSV malware advisory MAL-2026-6699 blocks this version. Package wires preinstall, install, and postinstall lifecycle hooks to run postinstall.js, which executes unconditionally on...
OpenSSF/OSV malware advisory MAL-2026-6702 blocks this version. vue-demi-fix is a name-confusion package against the widely used vue-demi library. package.json declares both preinstall an...
OpenSSF/OSV malware advisory MAL-2026-6701 blocks this version. The package's preinstall lifecycle hook (scripts.preinstall = "node index.js") auto-executes index.js on `npm install`. The...
OpenSSF/OSV malware advisory MAL-2026-6697 blocks this version. @sudoughnym/enviro-demo@99.99.99 ships preinstall.js and postinstall.js lifecycle scripts that run automatically on `npm in...
OpenSSF/OSV malware advisory MAL-2026-6696 blocks this version. @businessapp-microsites/apis@9999.0.2 is a dependency-confusion squat against the private scope `@businessapp-microsites`,...
OpenSSF/OSV malware advisory MAL-2026-6696 blocks this version. @businessapp-microsites/apis@9999.0.2 is a dependency-confusion squat against the private scope `@businessapp-microsites`,...
OpenSSF/OSV malware advisory MAL-2026-6588 blocks this version. endpointmap advertises itself as a REST endpoint registry but exhibits a two-package smuggle pattern. lib/registry.js expor...
OpenSSF/OSV malware advisory MAL-2026-6588 blocks this version. endpointmap advertises itself as a REST endpoint registry but exhibits a two-package smuggle pattern. lib/registry.js expor...
OpenSSF/OSV malware advisory MAL-2026-6555 blocks this version. The unscoped npm package `livekit-agents` advertises itself in README as the official LiveKit Agents SDK and links to livek...
OpenSSF/OSV malware advisory MAL-2026-6572 blocks this version. The package declares a `preinstall` hook that runs `node callback.js`. On `npm install`, `callback.js` collects installer-s...
OpenSSF/OSV malware advisory MAL-2026-6573 blocks this version. Package rebrandly-domains-search-client@9999.0.0 is an empty module (index.js exports an empty object) whose package.json p...
OpenSSF/OSV malware advisory MAL-2026-6532 blocks this version. chai-as-assured impersonates the popular chai-as-promised package (matching README, author, and API surface). When the expo...
OpenSSF/OSV malware advisory MAL-2026-6555 blocks this version. The unscoped npm package `livekit-agents` advertises itself in README as the official LiveKit Agents SDK and links to livek...
OpenSSF/OSV malware advisory MAL-2026-6555 blocks this version. The unscoped npm package `livekit-agents` advertises itself in README as the official LiveKit Agents SDK and links to livek...
OpenSSF/OSV malware advisory MAL-2026-6555 blocks this version. The unscoped npm package `livekit-agents` advertises itself in README as the official LiveKit Agents SDK and links to livek...
OpenSSF/OSV malware advisory MAL-2026-6674 blocks this version. package.json declares a preinstall lifecycle hook (`node index.js`) that auto-executes on `npm install`. index.js queries t...
OpenSSF/OSV malware advisory MAL-2026-6673 blocks this version. anthropic-toolkit@0.1.1 is a typosquat against the @anthropic-ai/sdk ecosystem. The package ships no library code — its dec...
OpenSSF/OSV malware advisory MAL-2026-6673 blocks this version. anthropic-toolkit@0.1.1 is a typosquat against the @anthropic-ai/sdk ecosystem. The package ships no library code — its dec...