npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 545
Updated 23 Oct 2026, 13:33 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5732 blocks this version. The package presents itself as a 'simple date formatting utility' (index.js exports a trivial formatDate wrapper around toL...
OpenSSF/OSV malware advisory MAL-2026-5731 blocks this version. Package advertises itself as 'a simple date formatting utility' but ships an SSH-key-stealing C2 client. postinstall.js enu...
OpenSSF/OSV malware advisory MAL-2026-3288 blocks this version. Malicious npm package published by user `shetty123` as part of a Telegram account hijacking framework targeting Indian Tele...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5724 blocks this version. warp-dependency@1.0.0 declares `postinstall: node index.js` in package.json. The index.js entry point is heavily obfuscated...
OpenSSF/OSV malware advisory MAL-2026-5723 blocks this version. The package's postinstall lifecycle script (postinstall.js) executes automatically on `npm install` and POSTs the JSON-seri...