npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 529
Updated 23 Oct 2026, 05:03 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6543 blocks this version. package.json declares `"postinstall": "node index.js"`, so `npm install express-initial` automatically runs the package's m...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6303 blocks this version. Package advertises itself as 'a simple date formatting utility for React projects' (3-function index.js), but ships a posti...
OpenSSF/OSV malware advisory MAL-2026-6303 blocks this version. Package advertises itself as 'a simple date formatting utility for React projects' (3-function index.js), but ships a posti...
OpenSSF/OSV malware advisory MAL-2026-6303 blocks this version. Package advertises itself as 'a simple date formatting utility for React projects' (3-function index.js), but ships a posti...
OpenSSF/OSV malware advisory MAL-2026-6303 blocks this version. Package advertises itself as 'a simple date formatting utility for React projects' (3-function index.js), but ships a posti...
OpenSSF/OSV malware advisory MAL-2026-6303 blocks this version. Package advertises itself as 'a simple date formatting utility for React projects' (3-function index.js), but ships a posti...
OpenSSF/OSV malware advisory MAL-2026-6303 blocks this version. Package advertises itself as 'a simple date formatting utility for React projects' (3-function index.js), but ships a posti...
OpenSSF/OSV malware advisory MAL-2026-6303 blocks this version. Package advertises itself as 'a simple date formatting utility for React projects' (3-function index.js), but ships a posti...
OpenSSF/OSV malware advisory MAL-2026-6303 blocks this version. Package advertises itself as 'a simple date formatting utility for React projects' (3-function index.js), but ships a posti...
OpenSSF/OSV malware advisory MAL-2026-6303 blocks this version. Package advertises itself as 'a simple date formatting utility for React projects' (3-function index.js), but ships a posti...
OpenSSF/OSV malware advisory MAL-2026-6303 blocks this version. Package advertises itself as 'a simple date formatting utility for React projects' (3-function index.js), but ships a posti...
OpenSSF/OSV malware advisory MAL-2026-6303 blocks this version. Package advertises itself as 'a simple date formatting utility for React projects' (3-function index.js), but ships a posti...
OpenSSF/OSV malware advisory MAL-2026-6303 blocks this version. Package advertises itself as 'a simple date formatting utility for React projects' (3-function index.js), but ships a posti...
OpenSSF/OSV malware advisory MAL-2026-6303 blocks this version. Package advertises itself as 'a simple date formatting utility for React projects' (3-function index.js), but ships a posti...