npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 548
Updated 23 Oct 2026, 14:58 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-6096 blocks this version. The package masquerades as a typosquat of the legacy `request`/`requests` HTTP library, copying that project's README, depe...
OpenSSF/OSV malware advisory MAL-2026-5697 blocks this version. On `npm install`, postinstall.js sends an HTTPS POST to https://ddactic-lab.online/sc/beacon carrying the package name/vers...
OpenSSF/OSV malware advisory MAL-2026-5980 blocks this version. The package advertises itself as a PostCSS plugin for CSS hardware-acceleration hints, but its only legitimate behavior is...
OpenSSF/OSV malware advisory MAL-2026-5701 blocks this version. On import/require of vite-react-toolkit, src/features/extras/config.js (reached via the package main → createConfig.js → fe...
OpenSSF/OSV malware advisory MAL-2026-6087 blocks this version. The package's only documented function, getJogos() (default export), unconditionally invokes an internal helper named prepa...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5693 blocks this version. On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full proces...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5693 blocks this version. On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full proces...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5693 blocks this version. On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full proces...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5693 blocks this version. On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full proces...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5693 blocks this version. On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full proces...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5693 blocks this version. On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full proces...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...
OpenSSF/OSV malware advisory MAL-2026-5693 blocks this version. On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full proces...
OpenSSF/OSV malware advisory MAL-2026-5693 blocks this version. On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full proces...
OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...