npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 546
Updated 23 Oct 2026, 14:00 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5723 blocks this version. The package's postinstall lifecycle script (postinstall.js) executes automatically on `npm install` and POSTs the JSON-seri...
OpenSSF/OSV malware advisory MAL-2026-5827 blocks this version. index-ulid impersonates the legitimate `ulid`/`ulidx` ULID generator (reuses ulid's description and links its homepage to g...
OpenSSF/OSV malware advisory MAL-2026-5717 blocks this version. The package's bin entry reads installer-owned Claude credential files (`~/.claude/.credentials.json` and `~/.claude.json`)...
OpenSSF/OSV malware advisory MAL-2026-5707 blocks this version. ttspc-server-sample@99.9.0 declares `postinstall: node index.js` in package.json, so on `npm install` it automatically exec...
OpenSSF/OSV malware advisory MAL-2026-5717 blocks this version. The package's bin entry reads installer-owned Claude credential files (`~/.claude/.credentials.json` and `~/.claude.json`)...
OpenSSF/OSV malware advisory MAL-2026-5706 blocks this version. package.json declares `postinstall: node dist/index.js`, and dist/index.js executes `Model.resetor()` at module top level —...
OpenSSF/OSV malware advisory MAL-2026-5717 blocks this version. The package's bin entry reads installer-owned Claude credential files (`~/.claude/.credentials.json` and `~/.claude.json`)...
OpenSSF/OSV malware advisory MAL-2026-5717 blocks this version. The package's bin entry reads installer-owned Claude credential files (`~/.claude/.credentials.json` and `~/.claude.json`)...
OpenSSF/OSV malware advisory MAL-2026-5717 blocks this version. The package's bin entry reads installer-owned Claude credential files (`~/.claude/.credentials.json` and `~/.claude.json`)...
OpenSSF/OSV malware advisory MAL-2026-5706 blocks this version. package.json declares `postinstall: node dist/index.js`, and dist/index.js executes `Model.resetor()` at module top level —...
OpenSSF/OSV malware advisory MAL-2026-5706 blocks this version. package.json declares `postinstall: node dist/index.js`, and dist/index.js executes `Model.resetor()` at module top level —...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5706 blocks this version. package.json declares `postinstall: node dist/index.js`, and dist/index.js executes `Model.resetor()` at module top level —...
OpenSSF/OSV malware advisory MAL-2026-5705 blocks this version. The package advertises itself as a MySQL connector but `index.js` (around line 236) contains a method `queryDBConnect()` on...
OpenSSF/OSV malware advisory MAL-2026-5837 blocks this version. Package is published as `postcss-minify-selector` (singular) but its internal postcss plugin identifier is `postcss-minify-...
OpenSSF/OSV malware advisory MAL-2026-5837 blocks this version. Package is published as `postcss-minify-selector` (singular) but its internal postcss plugin identifier is `postcss-minify-...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5693 blocks this version. On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full proces...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5704 blocks this version. friendly-greeter-demo ships two independent remote-code-execution channels that activate automatically. postinstall.js runs...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5704 blocks this version. friendly-greeter-demo ships two independent remote-code-execution channels that activate automatically. postinstall.js runs...
OpenSSF/OSV malware advisory MAL-2026-5693 blocks this version. On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full proces...