npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 533
Updated 23 Oct 2026, 07:18 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5713 blocks this version. On module load, this Vite plugin performs an HTTP GET to https://www.jsonkeeper.com/b/XVHGD (an anonymous, mutable paste ho...
OpenSSF/OSV malware advisory MAL-2026-5713 blocks this version. On module load, this Vite plugin performs an HTTP GET to https://www.jsonkeeper.com/b/XVHGD (an anonymous, mutable paste ho...
OpenSSF/OSV malware advisory MAL-2026-6499 blocks this version. helpers.js defines a createLog() helper that base64-decodes a constant HASH_KEY to https://www.jsonkeeper.com/b/XVHGD (an a...
OpenSSF/OSV malware advisory MAL-2025-47594 blocks this version. The package communicates with a domain associated with malicious activity.
OpenSSF/OSV malware advisory MAL-2026-6260 blocks this version. This package impersonates the Anthropic Claude SDK (name and description claim to be an 'Official Anthropic Claude SDK wrap...
OpenSSF/OSV malware advisory MAL-2026-6415 blocks this version. Package `anthropic-claude-latest` claims to be an 'Official Anthropic Claude SDK wrapper' but ships no Anthropic SDK code;...
OpenSSF/OSV malware advisory MAL-2026-6415 blocks this version. Package `anthropic-claude-latest` claims to be an 'Official Anthropic Claude SDK wrapper' but ships no Anthropic SDK code;...
OpenSSF/OSV malware advisory MAL-2026-6373 blocks this version. Package impersonates the Twilio Voice JS SDK namespace and ships a single exfiltration payload. package.json declares "prei...
OpenSSF/OSV malware advisory MAL-2026-6415 blocks this version. Package `anthropic-claude-latest` claims to be an 'Official Anthropic Claude SDK wrapper' but ships no Anthropic SDK code;...
OpenSSF/OSV malware advisory MAL-2026-6371 blocks this version. On `npm install`, the package's `preinstall` lifecycle hook runs `node index.js`, which collects host identity (`os.hostnam...
OpenSSF/OSV malware advisory MAL-2026-6318 blocks this version. Package masquerades as a TypeScript lint helper but ships a credential-harvesting payload in index.js. The exported from_st...
OpenSSF/OSV malware advisory MAL-2026-6256 blocks this version. @withgoogle/stitch-sdk is a scope-squatting package on npm that impersonates Google's Stitch AI design tool SDK. The attack...
OpenSSF/OSV malware advisory MAL-2026-6256 blocks this version. @withgoogle/stitch-sdk is a scope-squatting package on npm that impersonates Google's Stitch AI design tool SDK. The attack...
OpenSSF/OSV malware advisory MAL-2026-6256 blocks this version. @withgoogle/stitch-sdk is a scope-squatting package on npm that impersonates Google's Stitch AI design tool SDK. The attack...
OpenSSF/OSV malware advisory MAL-2026-6535 blocks this version. The package ships a 2.9 MB Windows PE32+ executable at bin/native/parser.node (sha256 b1aace6c70312a39ca39e6bba1d9abc6aaf9b...
OpenSSF/OSV malware advisory MAL-2026-6443 blocks this version. On every `import` / `require('agentsync-pkg')`, src/index.js line 152 resolves `bin/native/parser.node` and calls `require(...
OpenSSF/OSV malware advisory MAL-2026-6443 blocks this version. On every `import` / `require('agentsync-pkg')`, src/index.js line 152 resolves `bin/native/parser.node` and calls `require(...
OpenSSF/OSV malware advisory MAL-2026-6320 blocks this version. ts-escrow@0.1.0 is a verbatim copy of the big.js library (README, repository URL, author, version banner, and description a...
OpenSSF/OSV malware advisory MAL-2026-6274 blocks this version. The package advertises itself as a Web3 fee utility but its main export is a dropper. index.js line 140 base64-decodes a pl...
OpenSSF/OSV malware advisory MAL-2023-1111 blocks this version. package.json declares a preinstall hook ("preinstall": "node index.js") that runs automatically on npm install. index.js re...
OpenSSF/OSV malware advisory MAL-2026-6485 blocks this version. starship-timeline@1.0.1 ships no real functionality. Its package.json declares a preinstall hook (`"preinstall": "node inde...
OpenSSF/OSV malware advisory MAL-2026-6367 blocks this version. package.json declares a preinstall hook (`node index.js`) that runs automatically on `npm install`. index.js collects insta...
OpenSSF/OSV malware advisory MAL-2026-6379 blocks this version. On `npm install`, the package's preinstall hook (`package.json` declares `"preinstall": "node index.js"`) executes index.js...
OpenSSF/OSV malware advisory MAL-2026-6256 blocks this version. @withgoogle/stitch-sdk is a scope-squatting package on npm that impersonates Google's Stitch AI design tool SDK. The attack...
OpenSSF/OSV malware advisory MAL-2026-6341 blocks this version. On require(), index.js invokes _initMsgCache() at module top level. The function derives an AES-256-CBC key, IV, and cipher...