npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 521
Updated 22 Oct 2026, 22:48 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3410 blocks this version. The package @miurba/alcazaba was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3409 blocks this version. The package mw-filesystem-events-nodream was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3404 blocks this version. The package @matjp/dvi-decode was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3387 blocks this version. The package @gaia-codesearch/gaia-api-python was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3394 blocks this version. The package @gaia-codesearch/gaia-api-typescript was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3399 blocks this version. The package money-badger-open-rpc-test-bugbount was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3397 blocks this version. The package tecken was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3397 blocks this version. The package tecken was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3387 blocks this version. The package @gaia-codesearch/gaia-api-python was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3394 blocks this version. The package @gaia-codesearch/gaia-api-typescript was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3353 blocks this version. The package money-badger-open-rpc was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3353 blocks this version. The package money-badger-open-rpc was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3351 blocks this version. The package @rivianlabs/dt-shop-bag-v0 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3350 blocks this version. The package @rivianlabs/dt-lib-lumberjack was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3349 blocks this version. The package @rivianlabs/dc-fe-app-web-rivian-com was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3348 blocks this version. The package @rivianlabs/bedrock was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3334 blocks this version. The package fanduel was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3330 blocks this version. The package seek-pass was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3329 blocks this version. The package api-typings was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3327 blocks this version. The package capacitor-plugin-service-worker was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3327 blocks this version. The package capacitor-plugin-service-worker was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3336 blocks this version. The package @channel_bot/xa0 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3335 blocks this version. The package @bank-widgets/whats-new was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3249 blocks this version. The package internal-company-module-test-1337 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3249 blocks this version. The package internal-company-module-test-1337 was found to contain malicious code.