npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 522
Updated 22 Oct 2026, 23:18 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3249 blocks this version. The package internal-company-module-test-1337 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3249 blocks this version. The package internal-company-module-test-1337 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3311 blocks this version. path-addon impersonates the Node.js core `path` module (package name `path-addon`, README claims to be 'an exact copy of th...
Source inspection confirms import-time runtime installation/loading of an undeclared package plus local environment/host collection, which is not aligned with a logger API and creates con...
Source inspection confirms hidden import-time host/env collection and unconsented runtime npm installation/execution of eth-tick from lib/writer.js. This is not package-aligned logger beh...
Source inspection confirms covert DNS exfiltration of host/project identifiers at install time and import time, implemented through obfuscated helper files and unrelated to package functi...
Direct source inspection found only package.json, but it contains an automatic preinstall webhook beacon that exfiltrates host metadata. This is malicious install-time data exfiltration d...
Source inspection confirms import-time global console hijacking with outbound forwarding of runtime values to attacker-controlled external services. The lack of install hooks lowers trigg...
Source inspection confirms the package main contains unconsented global console interception and outbound forwarding of runtime data to third-party endpoints. Even with a likely syntax er...
OpenSSF/OSV malware advisory MAL-2025-49456 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. a static rule a static pattern match (critical) flag...
Direct source inspection confirms import-reachable global control-surface mutation plus hardcoded external telemetry/exfiltration endpoints unrelated to a clearly declared package purpose...
The source shows import-time global mutation plus automatic uncaught-error forwarding to an external Firebase endpoint, which is concrete unconsented data exfiltration behavior rather tha...
Direct source inspection confirms import-time global console hijacking plus external forwarding of intercepted runtime data. This is concrete unconsented exfiltration behavior, not merely...
OpenSSF/OSV malware advisory MAL-2025-49456 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. a static rule a static pattern match (critical) flag...
OpenSSF/OSV malware advisory MAL-2025-49456 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. a static rule a static pattern match (critical) flag...
OpenSSF/OSV malware advisory MAL-2025-49456 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. a static rule a static pattern match (critical) flag...
Source inspection confirms concrete import-time global hijacking plus unconsented network exfiltration from host runtime console calls. This is not package-aligned behavior for a tiny pac...
Despite the parse error reducing immediate exploitability, the package main contains concrete global console hijacking and data exfiltration code to unrelated external services. This is m...
Direct inspection confirms concrete import-time global hijacking and runtime exfiltration in the package main entrypoint. The benign src/dist fetch helper does not mitigate the published...
OpenSSF/OSV malware advisory MAL-2026-6544 blocks this version. The package's postinstall script (`npm run smoke:pino`) executes index.js, which spawns a detached `node lib/initializeCall...
OpenSSF/OSV malware advisory MAL-2026-6544 blocks this version. The package's postinstall script (`npm run smoke:pino`) executes index.js, which spawns a detached `node lib/initializeCall...
OpenSSF/OSV malware advisory MAL-2026-6445 blocks this version. The package advertises itself as a Base58 encoder/decoder but on require() schedules a delayed payload that performs multip...
OpenSSF/OSV malware advisory MAL-2026-6532 blocks this version. chai-as-assured impersonates the popular chai-as-promised package (matching README, author, and API surface). When the expo...
OpenSSF/OSV malware advisory MAL-2026-6445 blocks this version. The package advertises itself as a Base58 encoder/decoder but on require() schedules a delayed payload that performs multip...
OpenSSF/OSV malware advisory MAL-2026-6445 blocks this version. The package advertises itself as a Base58 encoder/decoder but on require() schedules a delayed payload that performs multip...