npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 520
Updated 22 Oct 2026, 22:19 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6673 blocks this version. anthropic-toolkit@0.1.1 is a typosquat against the @anthropic-ai/sdk ecosystem. The package ships no library code — its dec...
OpenSSF/OSV malware advisory MAL-2026-3311 blocks this version. path-addon impersonates the Node.js core `path` module (package name `path-addon`, README claims to be 'an exact copy of th...
OpenSSF/OSV malware advisory MAL-2026-6209 blocks this version. @antoncarlos1/nodelamp@1.0.1 ships a single obfuscated index.js that runs a dropper on require(). The top-level IIFE constr...
OpenSSF/OSV malware advisory MAL-2026-3311 blocks this version. path-addon impersonates the Node.js core `path` module (package name `path-addon`, README claims to be 'an exact copy of th...
OpenSSF/OSV malware advisory MAL-2026-3311 blocks this version. path-addon impersonates the Node.js core `path` module (package name `path-addon`, README claims to be 'an exact copy of th...
OpenSSF/OSV malware advisory MAL-2026-3508 blocks this version. The package crypto-javascri was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3508 blocks this version. The package crypto-javascri was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3508 blocks this version. The package crypto-javascri was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3508 blocks this version. The package crypto-javascri was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3508 blocks this version. The package crypto-javascri was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3508 blocks this version. The package crypto-javascri was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3508 blocks this version. The package crypto-javascri was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3508 blocks this version. The package crypto-javascri was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3508 blocks this version. The package crypto-javascri was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3508 blocks this version. The package crypto-javascri was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3508 blocks this version. The package crypto-javascri was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3508 blocks this version. The package crypto-javascri was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3507 blocks this version. The package @mimecast-ui/components was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3506 blocks this version. The package @mimecast-ui/charts was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3508 blocks this version. The package crypto-javascri was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3508 blocks this version. The package crypto-javascri was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3508 blocks this version. The package crypto-javascri was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3420 blocks this version. The package noon-contracts was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3410 blocks this version. The package @miurba/alcazaba was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3409 blocks this version. The package mw-filesystem-events-nodream was found to contain malicious code.