npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 549
Updated 22 Oct 2026, 23:50 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6242 blocks this version. On `npm install`, the package runs install.js via the postinstall lifecycle hook. The script harvests installer-side secret...
OpenSSF/OSV malware advisory MAL-2026-6240 blocks this version. Package ships a postinstall hook (`package.json` scripts.postinstall: `node install.js`) that runs automatically on every `...
OpenSSF/OSV malware advisory MAL-2026-6241 blocks this version. package.json declares `"postinstall": "node install.js"`, causing install.js to run automatically on `npm install`. install...
OpenSSF/OSV malware advisory MAL-2026-6200 blocks this version. assert-kit@4.3.2 impersonates the chai assertion library (bundles chai's source, contributors, and API surface under a diff...
OpenSSF/OSV malware advisory MAL-2026-4268 blocks this version. callback.js collects host identity information (os.hostname(), os.userInfo()) and transmits it via https.get() to an extern...