npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 534
Updated 23 Oct 2026, 07:56 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6341 blocks this version. On require(), index.js invokes _initMsgCache() at module top level. The function derives an AES-256-CBC key, IV, and cipher...
OpenSSF/OSV malware advisory MAL-2026-6345 blocks this version. Package name `thurdweb` is a one-character substitution of the popular web3 SDK `thirdweb`, but the shipped source is a cop...
OpenSSF/OSV malware advisory MAL-2026-6343 blocks this version. Package is published as `thidweb` but its README, source comments, repo URL, and author metadata all identify it as big.js...
OpenSSF/OSV malware advisory MAL-2026-6342 blocks this version. The package's name 'therdweb' is a one-character variation of the popular 'thirdweb' SDK, while its contents (README, sourc...
OpenSSF/OSV malware advisory MAL-2026-6344 blocks this version. Package name impersonates the well-known 'thirdweb' brand but ships a verbatim copy of MikeMcl's big.js arithmetic library...
OpenSSF/OSV malware advisory MAL-2026-6340 blocks this version. Package 'rainbownkit' is a single-character typosquat of the popular Web3 library 'rainbowkit'. The shipped source, README,...
OpenSSF/OSV malware advisory MAL-2026-6339 blocks this version. The package publishes as `rainbokit` but ships a verbatim copy of the legitimate `big.js` library (matching author, reposit...
OpenSSF/OSV malware advisory MAL-2026-6338 blocks this version. index.js imports child_process and invokes execSync with bash and zsh shell strings (around lines 315 and 331). The pattern...
OpenSSF/OSV malware advisory MAL-2026-6319 blocks this version. The package ships a verbatim copy of MikeMcl/big.js v7.0.1 (same banner, MIT copyright, and API) but is published under a d...
OpenSSF/OSV malware advisory MAL-2026-6319 blocks this version. The package ships a verbatim copy of MikeMcl/big.js v7.0.1 (same banner, MIT copyright, and API) but is published under a d...
OpenSSF/OSV malware advisory MAL-2026-6475 blocks this version. The package presents itself as a Tailwind CSS typography plugin (its name, description, and source tree clone @tailwindcss/...
OpenSSF/OSV malware advisory MAL-2026-6198 blocks this version. Package `new-ecro-1` impersonates the legitimate `big.js` library by shipping its source verbatim (banner, license, and hom...
OpenSSF/OSV malware advisory MAL-2026-6198 blocks this version. Package `new-ecro-1` impersonates the legitimate `big.js` library by shipping its source verbatim (banner, license, and hom...
OpenSSF/OSV malware advisory MAL-2026-6229 blocks this version. routecraft@4.2.0 ships verbatim Express.js source (lib/routecraft.js, lib/application.js, lib/request.js, lib/response.js,...
OpenSSF/OSV malware advisory MAL-2026-6187 blocks this version. Package masquerades as an ESLint utility but contains no lint-related code. The exported from_str() recursively walks proce...
OpenSSF/OSV malware advisory MAL-2026-6224 blocks this version. Package is published as 'new-eslint' but ships a verbatim copy of MikeMcl/big.js, with a hidden loader injected mid-file be...
OpenSSF/OSV malware advisory MAL-2026-6187 blocks this version. Package masquerades as an ESLint utility but contains no lint-related code. The exported from_str() recursively walks proce...
OpenSSF/OSV malware advisory MAL-2026-6143 blocks this version. On install, postinstall.js executes automatically and exfiltrates host reconnaissance data to attacker-controlled subdomain...
OpenSSF/OSV malware advisory MAL-2026-6199 blocks this version. ts-big-ecro is a verbatim copy of the legitimate big.js library (MikeMcl/big.js v7.0.1) with its name, repository field, an...
OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...
OpenSSF/OSV malware advisory MAL-2026-6477 blocks this version. lib/index.cjs and lib/index.mjs (re-required from lib/readonly.cjs) contain a self-executing IIFE that decodes two opaque s...
OpenSSF/OSV malware advisory MAL-2026-6213 blocks this version. The package advertises itself as a small in-memory pubsub library but its main entry `dist/index.js` eagerly `require()`s `...
OpenSSF/OSV malware advisory MAL-2026-6213 blocks this version. The package advertises itself as a small in-memory pubsub library but its main entry `dist/index.js` eagerly `require()`s `...
OpenSSF/OSV malware advisory MAL-2026-5973 blocks this version. The package masquerades as a Tailwind plugin: README and the top of src/index.js are a verbatim clone of @tailwindcss/typog...
OpenSSF/OSV malware advisory MAL-2026-6313 blocks this version. @zynkit/jwtbytes (malicious version 0.5.3, published by zynkit-sk393b@wshu.net) is a trojanized npm package belonging to th...