npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 523
Updated 22 Oct 2026, 23:50 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6445 blocks this version. The package advertises itself as a Base58 encoder/decoder but on require() schedules a delayed payload that performs multip...
OpenSSF/OSV malware advisory MAL-2026-6405 blocks this version. On require, index.js silently bootstraps a full Python runtime on the installer's machine — first via `winget install -e --...
OpenSSF/OSV malware advisory MAL-2026-6445 blocks this version. The package advertises itself as a Base58 encoder/decoder but on require() schedules a delayed payload that performs multip...
OpenSSF/OSV malware advisory MAL-2026-6346 blocks this version. package.json declares `preinstall: node index.js`, so the payload runs automatically on `npm install` with no user action....
OpenSSF/OSV malware advisory MAL-2026-6142 blocks this version. db-connector-log@1.0.1 impersonates the legitimate dx-db-connector package (divbloxjs); package.json's repository/homepage...
OpenSSF/OSV malware advisory MAL-2026-6538 blocks this version. On every Model instantiation — the package's documented primary API — dist/index.js executes `execSync('npm install db-conn...
OpenSSF/OSV malware advisory MAL-2026-5394 blocks this version. @sql-access/nodesql@1.1.3 is a decoy package whose identity, README, and code do not match. The package name and keywords a...
OpenSSF/OSV malware advisory MAL-2026-5396 blocks this version. The package advertises itself as a SQLite toolkit but ships no SQLite functionality. Its main entry (index.js) is a single...
OpenSSF/OSV malware advisory MAL-2026-5394 blocks this version. @sql-access/nodesql@1.1.3 is a decoy package whose identity, README, and code do not match. The package name and keywords a...
OpenSSF/OSV malware advisory MAL-2026-5396 blocks this version. The package advertises itself as a SQLite toolkit but ships no SQLite functionality. Its main entry (index.js) is a single...
OpenSSF/OSV malware advisory MAL-2026-5394 blocks this version. @sql-access/nodesql@1.1.3 is a decoy package whose identity, README, and code do not match. The package name and keywords a...
OpenSSF/OSV malware advisory MAL-2026-5396 blocks this version. The package advertises itself as a SQLite toolkit but ships no SQLite functionality. Its main entry (index.js) is a single...
OpenSSF/OSV malware advisory MAL-2026-5396 blocks this version. The package advertises itself as a SQLite toolkit but ships no SQLite functionality. Its main entry (index.js) is a single...
OpenSSF/OSV malware advisory MAL-2026-5396 blocks this version. The package advertises itself as a SQLite toolkit but ships no SQLite functionality. Its main entry (index.js) is a single...
OpenSSF/OSV malware advisory MAL-2026-5396 blocks this version. The package advertises itself as a SQLite toolkit but ships no SQLite functionality. Its main entry (index.js) is a single...
OpenSSF/OSV malware advisory MAL-2026-5396 blocks this version. The package advertises itself as a SQLite toolkit but ships no SQLite functionality. Its main entry (index.js) is a single...
OpenSSF/OSV malware advisory MAL-2026-5396 blocks this version. The package advertises itself as a SQLite toolkit but ships no SQLite functionality. Its main entry (index.js) is a single...
OpenSSF/OSV malware advisory MAL-2026-5394 blocks this version. @sql-access/nodesql@1.1.3 is a decoy package whose identity, README, and code do not match. The package name and keywords a...
OpenSSF/OSV malware advisory MAL-2026-5396 blocks this version. The package advertises itself as a SQLite toolkit but ships no SQLite functionality. Its main entry (index.js) is a single...
OpenSSF/OSV malware advisory MAL-2026-5394 blocks this version. @sql-access/nodesql@1.1.3 is a decoy package whose identity, README, and code do not match. The package name and keywords a...
OpenSSF/OSV malware advisory MAL-2026-5396 blocks this version. The package advertises itself as a SQLite toolkit but ships no SQLite functionality. Its main entry (index.js) is a single...
OpenSSF/OSV malware advisory MAL-2026-5394 blocks this version. @sql-access/nodesql@1.1.3 is a decoy package whose identity, README, and code do not match. The package name and keywords a...
OpenSSF/OSV malware advisory MAL-2026-5394 blocks this version. @sql-access/nodesql@1.1.3 is a decoy package whose identity, README, and code do not match. The package name and keywords a...
OpenSSF/OSV malware advisory MAL-2026-5394 blocks this version. @sql-access/nodesql@1.1.3 is a decoy package whose identity, README, and code do not match. The package name and keywords a...
OpenSSF/OSV malware advisory MAL-2026-5394 blocks this version. @sql-access/nodesql@1.1.3 is a decoy package whose identity, README, and code do not match. The package name and keywords a...