npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 540
Updated 23 Oct 2026, 10:55 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5931 blocks this version. On `npm install`, mci-sdk runs the postinstall hook `node./src/exec.js`, which imports `mci` from `src/core/index.js` and i...
OpenSSF/OSV malware advisory MAL-2026-5931 blocks this version. On `npm install`, mci-sdk runs the postinstall hook `node./src/exec.js`, which imports `mci` from `src/core/index.js` and i...
OpenSSF/OSV malware advisory MAL-2026-5909 blocks this version. package.json declares a postinstall hook that runs `node -e` to issue an HTTPS request to the bare IP 8.140.205.78 on port...
OpenSSF/OSV malware advisory MAL-2026-5909 blocks this version. package.json declares a postinstall hook that runs `node -e` to issue an HTTPS request to the bare IP 8.140.205.78 on port...
OpenSSF/OSV malware advisory MAL-2026-5909 blocks this version. package.json declares a postinstall hook that runs `node -e` to issue an HTTPS request to the bare IP 8.140.205.78 on port...
OpenSSF/OSV malware advisory MAL-2026-5911 blocks this version. package.json declares a postinstall lifecycle hook that runs `curl -s http://8.140.205.78 -o /dev/null` on every install. T...
OpenSSF/OSV malware advisory MAL-2026-5913 blocks this version. Package is published as `mastraqqq` but bundles a verbatim clone of the legitimate `mastra` CLI: the embedded package metad...
OpenSSF/OSV malware advisory MAL-2026-6229 blocks this version. routecraft@4.2.0 ships verbatim Express.js source (lib/routecraft.js, lib/application.js, lib/request.js, lib/response.js,...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5704 blocks this version. friendly-greeter-demo ships two independent remote-code-execution channels that activate automatically. postinstall.js runs...
OpenSSF/OSV malware advisory MAL-2026-5704 blocks this version. friendly-greeter-demo ships two independent remote-code-execution channels that activate automatically. postinstall.js runs...
OpenSSF/OSV malware advisory MAL-2026-5934 blocks this version. On require('ssr-auth-sync'), index.js loads lib/writer.js, which immediately fetches a base64-hidden URL (https://www.jsonk...
OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...
OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...
OpenSSF/OSV malware advisory MAL-2026-4422 blocks this version. Package `@qwedqwed/axios` is published under a scope that does not belong to the real axios maintainers but copies axios's...
OpenSSF/OSV malware advisory MAL-2026-4422 blocks this version. Package `@qwedqwed/axios` is published under a scope that does not belong to the real axios maintainers but copies axios's...
OpenSSF/OSV malware advisory MAL-2026-5885 blocks this version. On `npm install`, the declared postinstall hook runs `node main.js`, which decodes an obfuscated URL (stored as `DEV_API_KE...
OpenSSF/OSV malware advisory MAL-2026-5885 blocks this version. On `npm install`, the declared postinstall hook runs `node main.js`, which decodes an obfuscated URL (stored as `DEV_API_KE...
OpenSSF/OSV malware advisory MAL-2026-5936 blocks this version. vite-config-field@1.1.0 impersonates the legitimate vite-plugin-pwa package (README copies its banner/badges, funding field...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...