npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 524
Updated 23 Oct 2026, 00:13 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5396 blocks this version. The package advertises itself as a SQLite toolkit but ships no SQLite functionality. Its main entry (index.js) is a single...
OpenSSF/OSV malware advisory MAL-2026-5394 blocks this version. @sql-access/nodesql@1.1.3 is a decoy package whose identity, README, and code do not match. The package name and keywords a...
OpenSSF/OSV malware advisory MAL-2026-5396 blocks this version. The package advertises itself as a SQLite toolkit but ships no SQLite functionality. Its main entry (index.js) is a single...
OpenSSF/OSV malware advisory MAL-2026-5604 blocks this version. package.json declares a postinstall hook (`node -e "require('./loader.js')"`) that runs automatically on every `npm install...
OpenSSF/OSV malware advisory MAL-2026-5395 blocks this version. The package advertises itself as a simple SQL helper but its main entry index.js is heavily obfuscated (obfuscator.io strin...
OpenSSF/OSV malware advisory MAL-2026-5394 blocks this version. @sql-access/nodesql@1.1.3 is a decoy package whose identity, README, and code do not match. The package name and keywords a...
OpenSSF/OSV malware advisory MAL-2026-5396 blocks this version. The package advertises itself as a SQLite toolkit but ships no SQLite functionality. Its main entry (index.js) is a single...
OpenSSF/OSV malware advisory MAL-2026-5394 blocks this version. @sql-access/nodesql@1.1.3 is a decoy package whose identity, README, and code do not match. The package name and keywords a...
OpenSSF/OSV malware advisory MAL-2026-5396 blocks this version. The package advertises itself as a SQLite toolkit but ships no SQLite functionality. Its main entry (index.js) is a single...
OpenSSF/OSV malware advisory MAL-2026-5188 blocks this version. package.json declares a postinstall script that, on npm install, (1) enumerates process.env plus os.hostname(), os.platform...
OpenSSF/OSV malware advisory MAL-2026-5188 blocks this version. package.json declares a postinstall script that, on npm install, (1) enumerates process.env plus os.hostname(), os.platform...
OpenSSF/OSV malware advisory MAL-2026-5188 blocks this version. package.json declares a postinstall script that, on npm install, (1) enumerates process.env plus os.hostname(), os.platform...
OpenSSF/OSV malware advisory MAL-2026-5188 blocks this version. package.json declares a postinstall script that, on npm install, (1) enumerates process.env plus os.hostname(), os.platform...
OpenSSF/OSV malware advisory MAL-2026-5188 blocks this version. package.json declares a postinstall script that, on npm install, (1) enumerates process.env plus os.hostname(), os.platform...
OpenSSF/OSV malware advisory MAL-2026-5395 blocks this version. The package advertises itself as a simple SQL helper but its main entry index.js is heavily obfuscated (obfuscator.io strin...
OpenSSF/OSV malware advisory MAL-2026-5394 blocks this version. @sql-access/nodesql@1.1.3 is a decoy package whose identity, README, and code do not match. The package name and keywords a...
OpenSSF/OSV malware advisory MAL-2026-6495 blocks this version. animatecss-postcss-plugin@1.0.1 ships a tiny PostCSS plugin factory whose body contains an obfuscator.io-style string-array...
OpenSSF/OSV malware advisory MAL-2026-4681 blocks this version. Package name 'tailwind-typography-stylecss' impersonates the official '@tailwindcss/typography' plugin; the shipped README...
OpenSSF/OSV malware advisory MAL-2026-3509 blocks this version. `pp-react-v5` is a dependency confusion package published at the inflated version `10.0.0` to win npm resolution over any i...
OpenSSF/OSV malware advisory MAL-2026-6533 blocks this version. Package name misspells 'component' as 'compenent', a one-letter typosquat of react-dynamic-table-component. The package's p...
OpenSSF/OSV malware advisory MAL-2026-6534 blocks this version. react-dynammic-table-component@1.2.7 declares a `preinstall` lifecycle script (`node dist/setup.js`) that runs automaticall...
OpenSSF/OSV malware advisory MAL-2026-6526 blocks this version. The package ships a binding.gyp at the package root whose targets/sources fields contain GYP command-expansion syntax (<!(....
OpenSSF/OSV malware advisory MAL-2026-6526 blocks this version. The package ships a binding.gyp at the package root whose targets/sources fields contain GYP command-expansion syntax (<!(....
OpenSSF/OSV malware advisory MAL-2026-6526 blocks this version. The package ships a binding.gyp at the package root whose targets/sources fields contain GYP command-expansion syntax (<!(....
OpenSSF/OSV malware advisory MAL-2026-6526 blocks this version. The package ships a binding.gyp at the package root whose targets/sources fields contain GYP command-expansion syntax (<!(....