npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 525
Updated 23 Oct 2026, 00:39 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6526 blocks this version. The package ships a binding.gyp at the package root whose targets/sources fields contain GYP command-expansion syntax (<!(....
OpenSSF/OSV malware advisory MAL-2026-6526 blocks this version. The package ships a binding.gyp at the package root whose targets/sources fields contain GYP command-expansion syntax (<!(....
OpenSSF/OSV malware advisory MAL-2026-6526 blocks this version. The package ships a binding.gyp at the package root whose targets/sources fields contain GYP command-expansion syntax (<!(....
OpenSSF/OSV malware advisory MAL-2026-6531 blocks this version. Package @appupdate/cdn-sync ships as a thin koffi wrapper around prebuilt Go cgo native libraries (~12MB linux.so, ~11MB da...
OpenSSF/OSV malware advisory MAL-2026-6530 blocks this version. Package `xrblocks-remote-control` ships a `bin` script that, when invoked (including via `npx` or unintended resolution aga...
OpenSSF/OSV malware advisory MAL-2026-6512 blocks this version. react-context-form-tdsss@9.0.0 is a dependency-confusion payload. package.json declares scripts.preinstall="node index.js",...
OpenSSF/OSV malware advisory MAL-2026-6497 blocks this version. chai-as-synced@7.0.9 impersonates the pino logger: it ships pino's README, LICENSE, docs/, index.d.ts and lib/ file layout...
OpenSSF/OSV malware advisory MAL-2026-6482 blocks this version. On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: i...
OpenSSF/OSV malware advisory MAL-2026-6482 blocks this version. On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: i...
OpenSSF/OSV malware advisory MAL-2026-6482 blocks this version. On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: i...
OpenSSF/OSV malware advisory MAL-2026-6482 blocks this version. On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: i...
OpenSSF/OSV malware advisory MAL-2026-6482 blocks this version. On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: i...
OpenSSF/OSV malware advisory MAL-2026-6469 blocks this version. Package ships a verbatim copy of big.js v7.0.1 (including the original author metadata 'Michael Mclaughlin <M8ch88l@gmail.c...
OpenSSF/OSV malware advisory MAL-2026-6490 blocks this version. index.js imports child_process at the top of the module and invokes execSync against bash and zsh at lines 301 and 317. The...
OpenSSF/OSV malware advisory MAL-2026-6483 blocks this version. Package masquerades as Sindre Sorhus's popular 'log-update' library (matching name and description claiming 'Log by overwri...
OpenSSF/OSV malware advisory MAL-2026-6446 blocks this version. Package impersonates the legitimate base-x/base62 library by Daniel Cousens (name `base62-86x`, homepage pointing at crypto...
OpenSSF/OSV malware advisory MAL-2026-6448 blocks this version. Package `bs58-86@6.0.1` reproduces the name, README, repository URL (`cryptocoinjs/bs58`), and exported API of the widely-u...
OpenSSF/OSV malware advisory MAL-2026-6446 blocks this version. Package impersonates the legitimate base-x/base62 library by Daniel Cousens (name `base62-86x`, homepage pointing at crypto...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...