npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 527
Updated 23 Oct 2026, 04:00 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6482 blocks this version. On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: i...
OpenSSF/OSV malware advisory MAL-2026-6482 blocks this version. On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: i...
OpenSSF/OSV malware advisory MAL-2026-6482 blocks this version. On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: i...
OpenSSF/OSV malware advisory MAL-2026-6482 blocks this version. On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: i...
OpenSSF/OSV malware advisory MAL-2026-6469 blocks this version. Package ships a verbatim copy of big.js v7.0.1 (including the original author metadata 'Michael Mclaughlin <M8ch88l@gmail.c...
OpenSSF/OSV malware advisory MAL-2026-6490 blocks this version. index.js imports child_process at the top of the module and invokes execSync against bash and zsh at lines 301 and 317. The...
OpenSSF/OSV malware advisory MAL-2026-6483 blocks this version. Package masquerades as Sindre Sorhus's popular 'log-update' library (matching name and description claiming 'Log by overwri...
OpenSSF/OSV malware advisory MAL-2026-6446 blocks this version. Package impersonates the legitimate base-x/base62 library by Daniel Cousens (name `base62-86x`, homepage pointing at crypto...
OpenSSF/OSV malware advisory MAL-2026-6448 blocks this version. Package `bs58-86@6.0.1` reproduces the name, README, repository URL (`cryptocoinjs/bs58`), and exported API of the widely-u...
OpenSSF/OSV malware advisory MAL-2026-6446 blocks this version. Package impersonates the legitimate base-x/base62 library by Daniel Cousens (name `base62-86x`, homepage pointing at crypto...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-6396 blocks this version. signup-embedder@99.99.99-poc2 ships preinstall.js and postinstall.js lifecycle scripts that auto-execute on `npm install`....