npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 531
Updated 23 Oct 2026, 06:11 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6440 blocks this version. The package advertises plain math/formatter helpers but index.js contains a heavily obfuscated payload concealed inside the...
OpenSSF/OSV malware advisory MAL-2026-6278 blocks this version. Package is published under the name `ts-wross` but its package.json claims authorship by Michael Mclaughlin (M8ch88l@gmail....
OpenSSF/OSV malware advisory MAL-2026-6275 blocks this version. The published tarball's dist/index.js contains an obfuscated payload that runs at require() time inside a setTimeout-wrappe...
OpenSSF/OSV malware advisory MAL-2026-6275 blocks this version. The published tarball's dist/index.js contains an obfuscated payload that runs at require() time inside a setTimeout-wrappe...
OpenSSF/OSV malware advisory MAL-2026-6275 blocks this version. The published tarball's dist/index.js contains an obfuscated payload that runs at require() time inside a setTimeout-wrappe...
OpenSSF/OSV malware advisory MAL-2026-6275 blocks this version. The published tarball's dist/index.js contains an obfuscated payload that runs at require() time inside a setTimeout-wrappe...
OpenSSF/OSV malware advisory MAL-2026-6275 blocks this version. The published tarball's dist/index.js contains an obfuscated payload that runs at require() time inside a setTimeout-wrappe...
OpenSSF/OSV malware advisory MAL-2026-6325 blocks this version. Package name and metadata impersonate the legitimate @ethereumjs/util / ethereumjs-util packages: README is copied verbatim...
OpenSSF/OSV malware advisory MAL-2026-6365 blocks this version. Package `assertcore` impersonates the popular `chai` assertion library (ships a copy of chai source as cover; author and ho...
OpenSSF/OSV malware advisory MAL-2026-6496 blocks this version. Package `@dervix/ws` impersonates the popular `ws` WebSocket library — `package.json` copies the legitimate ws project's ho...
OpenSSF/OSV malware advisory MAL-2026-6542 blocks this version. The package republishes the upstream `treeify` library (Luke Plaster, repo notatestuser/treeify) verbatim under the unrelat...
OpenSSF/OSV malware advisory MAL-2026-6496 blocks this version. Package `@dervix/ws` impersonates the popular `ws` WebSocket library — `package.json` copies the legitimate ws project's ho...
OpenSSF/OSV malware advisory MAL-2026-6542 blocks this version. The package republishes the upstream `treeify` library (Luke Plaster, repo notatestuser/treeify) verbatim under the unrelat...
OpenSSF/OSV malware advisory MAL-2026-6309 blocks this version. @nullzero/urlcat (version 1.4.2, published by nullzero-rlnozk@wshu.net) is a trojanized npm package belonging to the wshu.n...
OpenSSF/OSV malware advisory MAL-2026-6470 blocks this version. Package name `chlklib` is a one-character deletion of the popular `chalk` package and replicates chalk's public API surface...
OpenSSF/OSV malware advisory MAL-2026-6470 blocks this version. Package name `chlklib` is a one-character deletion of the popular `chalk` package and replicates chalk's public API surface...
OpenSSF/OSV malware advisory MAL-2026-6470 blocks this version. Package name `chlklib` is a one-character deletion of the popular `chalk` package and replicates chalk's public API surface...
OpenSSF/OSV malware advisory MAL-2026-6470 blocks this version. Package name `chlklib` is a one-character deletion of the popular `chalk` package and replicates chalk's public API surface...
OpenSSF/OSV malware advisory MAL-2026-6260 blocks this version. This package impersonates the Anthropic Claude SDK (name and description claim to be an 'Official Anthropic Claude SDK wrap...
OpenSSF/OSV malware advisory MAL-2026-6260 blocks this version. This package impersonates the Anthropic Claude SDK (name and description claim to be an 'Official Anthropic Claude SDK wrap...
OpenSSF/OSV malware advisory MAL-2026-6271 blocks this version. On Windows, scripts/postinstall.js XOR-decodes a hardcoded C2 host (node22.lunes.host:3258), authenticates with a 5-minute...
OpenSSF/OSV malware advisory MAL-2026-6271 blocks this version. On Windows, scripts/postinstall.js XOR-decodes a hardcoded C2 host (node22.lunes.host:3258), authenticates with a 5-minute...
OpenSSF/OSV malware advisory MAL-2026-6271 blocks this version. On Windows, scripts/postinstall.js XOR-decodes a hardcoded C2 host (node22.lunes.host:3258), authenticates with a 5-minute...
OpenSSF/OSV malware advisory MAL-2026-6275 blocks this version. The published tarball's dist/index.js contains an obfuscated payload that runs at require() time inside a setTimeout-wrappe...
OpenSSF/OSV malware advisory MAL-2026-6271 blocks this version. On Windows, scripts/postinstall.js XOR-decodes a hardcoded C2 host (node22.lunes.host:3258), authenticates with a 5-minute...