npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 553
Updated 23 Oct 2026, 18:17 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6223 blocks this version. The package is published as 'mjs-eslint' but its description, file layout (big.js, big.mjs), and source are a verbatim copy...
OpenSSF/OSV malware advisory MAL-2026-5847 blocks this version. On import, the package's middleware spawns a detached `node lib/caller.js` child process. `caller.js` decodes a base64-obfu...
OpenSSF/OSV malware advisory MAL-2026-5623 blocks this version. No suspicious code, lifecycle scripts, network destinations, credential reads, or obfuscation were observed in this package...
OpenSSF/OSV malware advisory MAL-2026-5624 blocks this version. On `npm install`, postinstall.js reads the installer's `.env` file from INIT_CWD, harvests environment variable values (DEM...
OpenSSF/OSV malware advisory MAL-2026-5624 blocks this version. On `npm install`, postinstall.js reads the installer's `.env` file from INIT_CWD, harvests environment variable values (DEM...
OpenSSF/OSV malware advisory MAL-2026-5624 blocks this version. On `npm install`, postinstall.js reads the installer's `.env` file from INIT_CWD, harvests environment variable values (DEM...
OpenSSF/OSV malware advisory MAL-2026-5619 blocks this version. tailwind-typography-plus@2.1.0 impersonates the legitimate @tailwindcss/typography Tailwind CSS plugin (confusable name, co...
OpenSSF/OSV malware advisory MAL-2026-5618 blocks this version. The package's main entry src/index.js appends, after a large whitespace gap following the legitimate-looking Tailwind plugi...
OpenSSF/OSV malware advisory MAL-2026-5790 blocks this version. ldpbootstrap-jquery ships and executes an obfuscated Windows PowerShell payload as part of its documented usage. The packag...
OpenSSF/OSV malware advisory MAL-2026-5790 blocks this version. ldpbootstrap-jquery ships and executes an obfuscated Windows PowerShell payload as part of its documented usage. The packag...
OpenSSF/OSV malware advisory MAL-2026-5790 blocks this version. ldpbootstrap-jquery ships and executes an obfuscated Windows PowerShell payload as part of its documented usage. The packag...
OpenSSF/OSV malware advisory MAL-2026-5790 blocks this version. ldpbootstrap-jquery ships and executes an obfuscated Windows PowerShell payload as part of its documented usage. The packag...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-5566 blocks this version. fastify-addon is a typosquat of the legitimate fastify-plugin package. Its package.json sets repository, bugs, and homepage...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-5727 blocks this version. package.json declares a postinstall hook `node -e "require('./loader.js')"` that auto-executes on every `npm install`. load...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...