npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 544
Updated 22 Oct 2026, 21:21 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4266 blocks this version. package.json declares scripts.postinstall=node postinstall.js, which executes unconditionally on `npm install`. The script...
OpenSSF/OSV malware advisory MAL-2026-4177 blocks this version. On `npm install`, the package's postinstall script runs `node -e` to fetch the installer's public IP from api.ipify.org, ex...
OpenSSF/OSV malware advisory MAL-2026-4177 blocks this version. On `npm install`, the package's postinstall script runs `node -e` to fetch the installer's public IP from api.ipify.org, ex...
OpenSSF/OSV malware advisory MAL-2026-4177 blocks this version. On `npm install`, the package's postinstall script runs `node -e` to fetch the installer's public IP from api.ipify.org, ex...
OpenSSF/OSV malware advisory MAL-2026-4177 blocks this version. On `npm install`, the package's postinstall script runs `node -e` to fetch the installer's public IP from api.ipify.org, ex...