npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 530
Updated 23 Oct 2026, 05:34 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6303 blocks this version. Package advertises itself as 'a simple date formatting utility for React projects' (3-function index.js), but ships a posti...
OpenSSF/OSV malware advisory MAL-2026-6303 blocks this version. Package advertises itself as 'a simple date formatting utility for React projects' (3-function index.js), but ships a posti...
OpenSSF/OSV malware advisory MAL-2026-6303 blocks this version. Package advertises itself as 'a simple date formatting utility for React projects' (3-function index.js), but ships a posti...
OpenSSF/OSV malware advisory MAL-2026-6302 blocks this version. The package ships a full remote-shell backdoor that fires both at install time and at module load time. postinstall.js fork...
OpenSSF/OSV malware advisory MAL-2026-6273 blocks this version. The package is published under a name suggesting a Pino logger integration for Zod, but the tarball contents do not match t...
OpenSSF/OSV malware advisory MAL-2026-6273 blocks this version. The package is published under a name suggesting a Pino logger integration for Zod, but the tarball contents do not match t...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6274 blocks this version. The package advertises itself as a Web3 fee utility but its main export is a dropper. index.js line 140 base64-decodes a pl...
OpenSSF/OSV malware advisory MAL-2026-6274 blocks this version. The package advertises itself as a Web3 fee utility but its main export is a dropper. index.js line 140 base64-decodes a pl...
OpenSSF/OSV malware advisory MAL-2026-6274 blocks this version. The package advertises itself as a Web3 fee utility but its main export is a dropper. index.js line 140 base64-decodes a pl...
OpenSSF/OSV malware advisory MAL-2026-6274 blocks this version. The package advertises itself as a Web3 fee utility but its main export is a dropper. index.js line 140 base64-decodes a pl...
OpenSSF/OSV malware advisory MAL-2026-6273 blocks this version. The package is published under a name suggesting a Pino logger integration for Zod, but the tarball contents do not match t...
OpenSSF/OSV malware advisory MAL-2026-6271 blocks this version. On Windows, scripts/postinstall.js XOR-decodes a hardcoded C2 host (node22.lunes.host:3258), authenticates with a 5-minute...
OpenSSF/OSV malware advisory MAL-2026-6271 blocks this version. On Windows, scripts/postinstall.js XOR-decodes a hardcoded C2 host (node22.lunes.host:3258), authenticates with a 5-minute...
OpenSSF/OSV malware advisory MAL-2026-6440 blocks this version. The package advertises plain math/formatter helpers but index.js contains a heavily obfuscated payload concealed inside the...
OpenSSF/OSV malware advisory MAL-2026-6271 blocks this version. On Windows, scripts/postinstall.js XOR-decodes a hardcoded C2 host (node22.lunes.host:3258), authenticates with a 5-minute...
OpenSSF/OSV malware advisory MAL-2026-6368 blocks this version. The postinstall script scripts/sync-peer.cjs runs `npm pack decimal-format-utils@1.0.1` (or whatever version is configured...
OpenSSF/OSV malware advisory MAL-2026-6472 blocks this version. src/index.js appends a heavily obfuscated async IIFE after a legitimate-looking TailwindCSS plugin. On import, the IIFE iss...
OpenSSF/OSV malware advisory MAL-2026-6326 blocks this version. Package name, README, repository URL, contributors, and module structure are copied from the legitimate '@ethereumjs/util'...