npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 528
Updated 23 Oct 2026, 04:35 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6394 blocks this version. Package self-identifies in package.json as a dependency-confusion proof-of-concept targeting HubSpot's internal `hs-locale-...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-6439 blocks this version. On `npm install`, the package's postinstall script (scripts/install-check.cjs) fetches a JSON config from https://log-taker...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-6403 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-6404 blocks this version. Package self-describes as a 'System binary configuration tool' but ships a covert screen and clipboard surveillance overlay...
OpenSSF/OSV malware advisory MAL-2026-6404 blocks this version. Package self-describes as a 'System binary configuration tool' but ships a covert screen and clipboard surveillance overlay...
OpenSSF/OSV malware advisory MAL-2026-6437 blocks this version. On npm install, scripts/install-check.cjs (registered as a postinstall lifecycle script) fetches a JSON config from a hardc...
OpenSSF/OSV malware advisory MAL-2026-6396 blocks this version. signup-embedder@99.99.99-poc2 ships preinstall.js and postinstall.js lifecycle scripts that auto-execute on `npm install`....
OpenSSF/OSV malware advisory MAL-2026-6394 blocks this version. Package self-identifies in package.json as a dependency-confusion proof-of-concept targeting HubSpot's internal `hs-locale-...
OpenSSF/OSV malware advisory MAL-2026-2509 blocks this version. Package collects and sends sensitive system info to a hardcoded server. The package masquerades as a LangGraph JS utility b...
OpenSSF/OSV malware advisory MAL-2026-6438 blocks this version. The package ships a `postinstall` hook (`scripts/sync-peer.cjs`) that runs on every default `npm install`. The script compa...
OpenSSF/OSV malware advisory MAL-2026-6473 blocks this version. Package presents itself as a minimal React color-picker but ships a postinstall hook (`"postinstall": "node setup.js"`) tha...
OpenSSF/OSV malware advisory MAL-2026-6473 blocks this version. Package presents itself as a minimal React color-picker but ships a postinstall hook (`"postinstall": "node setup.js"`) tha...
OpenSSF/OSV malware advisory MAL-2026-6369 blocks this version. Package impersonates the well-known eth-gas-reporter / hardhat-gas-reporter packages: README is titled 'eth-test-log', copi...
OpenSSF/OSV malware advisory MAL-2026-6273 blocks this version. The package is published under a name suggesting a Pino logger integration for Zod, but the tarball contents do not match t...
OpenSSF/OSV malware advisory MAL-2026-6438 blocks this version. The package ships a `postinstall` hook (`scripts/sync-peer.cjs`) that runs on every default `npm install`. The script compa...
OpenSSF/OSV malware advisory MAL-2026-6406 blocks this version. Package is published under the cover story 'System binary configuration tool' but its actual behavior is a Windows surveill...
OpenSSF/OSV malware advisory MAL-2026-6374 blocks this version. Package declares `"bin": {"node": "./shim.js"}` in package.json, which registers `shim.js` as the `node` command in `node_m...
OpenSSF/OSV malware advisory MAL-2026-6374 blocks this version. Package declares `"bin": {"node": "./shim.js"}` in package.json, which registers `shim.js` as the `node` command in `node_m...
OpenSSF/OSV malware advisory MAL-2026-6273 blocks this version. The package is published under a name suggesting a Pino logger integration for Zod, but the tarball contents do not match t...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...