npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 542
Updated 23 Oct 2026, 12:00 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5777 blocks this version. package.json declares both preinstall and postinstall scripts that run curl against a hardcoded bare-IP HTTP endpoint (http...
OpenSSF/OSV malware advisory MAL-2026-5704 blocks this version. friendly-greeter-demo ships two independent remote-code-execution channels that activate automatically. postinstall.js runs...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5777 blocks this version. package.json declares both preinstall and postinstall scripts that run curl against a hardcoded bare-IP HTTP endpoint (http...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5973 blocks this version. The package masquerades as a Tailwind plugin: README and the top of src/index.js are a verbatim clone of @tailwindcss/typog...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...
OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...
OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...
OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...
OpenSSF/OSV malware advisory MAL-2026-5785 blocks this version. On `npm install`, the package's preinstall lifecycle invokes postinstall.js, which collects hostname, username, and current...
OpenSSF/OSV malware advisory MAL-2026-5783 blocks this version. On `npm install`, the package's preinstall hook (`preinstall: node postinstall.js || true`) executes postinstall.js, which...
OpenSSF/OSV malware advisory MAL-2026-5784 blocks this version. On `npm install`, the package's preinstall hook (`node postinstall.js || true`) executes automatically. The script collects...
OpenSSF/OSV malware advisory MAL-2026-5782 blocks this version. On `npm install`, the preinstall lifecycle script in postinstall.js enumerates process.env, filters keys matching a broad c...
OpenSSF/OSV malware advisory MAL-2026-5781 blocks this version. On `npm install`, the package's `preinstall` hook executes `postinstall.js`, which enumerates `process.env` and filters key...
OpenSSF/OSV malware advisory MAL-2026-6210 blocks this version. @apexcraft/nano-key advertises itself as a 12-byte sortable ID generator (README and repository metadata are copied from yi...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5790 blocks this version. ldpbootstrap-jquery ships and executes an obfuscated Windows PowerShell payload as part of its documented usage. The packag...
OpenSSF/OSV malware advisory MAL-2026-6309 blocks this version. @nullzero/urlcat (version 1.4.2, published by nullzero-rlnozk@wshu.net) is a trojanized npm package belonging to the wshu.n...
OpenSSF/OSV malware advisory MAL-2026-5838 blocks this version. On require, index.js performs an unconditional `http.get` to a unique subdomain of oastify.com (Burp Suite Collaborator out...
OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...
OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...
OpenSSF/OSV malware advisory MAL-2026-5772 blocks this version. The package's only code file (index.js, also registered as the package's bin entry) unconditionally executes `require('chil...
OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...