npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 547
Updated 23 Oct 2026, 14:27 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5704 blocks this version. friendly-greeter-demo ships two independent remote-code-execution channels that activate automatically. postinstall.js runs...
OpenSSF/OSV malware advisory MAL-2026-5693 blocks this version. On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full proces...
OpenSSF/OSV malware advisory MAL-2026-5693 blocks this version. On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full proces...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5693 blocks this version. On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full proces...
OpenSSF/OSV malware advisory MAL-2026-5693 blocks this version. On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full proces...
OpenSSF/OSV malware advisory MAL-2026-5693 blocks this version. On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full proces...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5704 blocks this version. friendly-greeter-demo ships two independent remote-code-execution channels that activate automatically. postinstall.js runs...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5693 blocks this version. On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full proces...
OpenSSF/OSV malware advisory MAL-2026-5707 blocks this version. ttspc-server-sample@99.9.0 declares `postinstall: node index.js` in package.json, so on `npm install` it automatically exec...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5693 blocks this version. On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full proces...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5693 blocks this version. On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full proces...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...