npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 554
Updated 23 Oct 2026, 18:54 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-6457 blocks this version. The package's main entry `index.js` is the only file of substance and is wrapped in obfuscator.io string-array + RC4 obfusc...
OpenSSF/OSV malware advisory MAL-2026-6084 blocks this version. @array-util/nodepull@1.1.1 ships a single 19 KB obfuscated index.js as its main entry. On require()/import, the IIFE silenc...
OpenSSF/OSV malware advisory MAL-2026-6457 blocks this version. The package's main entry `index.js` is the only file of substance and is wrapped in obfuscator.io string-array + RC4 obfusc...
OpenSSF/OSV malware advisory MAL-2026-5491 blocks this version. The package ships scripts/script.js containing heavy obfuscation patterns (string-array shift rotation, hex-encoded numeric...
OpenSSF/OSV malware advisory MAL-2026-6183 blocks this version. preinstall.js, registered as scripts.preinstall and also required from the main module and every bin entry, collects os.hos...
OpenSSF/OSV malware advisory MAL-2026-5087 blocks this version. buffer-utilities impersonates the legitimate `buffer` package by Feross Aboukhadijeh, copying its name, email, homepage, an...
OpenSSF/OSV malware advisory MAL-2026-2929 blocks this version. On require(), path.js runs an IIFE that calls a loader which fetches a base64-hidden URL (https://www.jsonkeeper.com/b/XTTB...
OpenSSF/OSV malware advisory MAL-2026-4592 blocks this version. On require()/import of jsontoken-extend, sign.js executes a top-level IIFE that base64-decodes a hardcoded string to https:...
OpenSSF/OSV malware advisory MAL-2026-6316 blocks this version. Package is published as 'ts-biginteger-lib' but its metadata, README, and source are a wholesale copy of big.js by MikeMcl...
OpenSSF/OSV malware advisory MAL-2026-6195 blocks this version. index.js imports child_process and contains a hardcoded outbound POST to https://tg-wallet-manager.vercel.app, with additio...
OpenSSF/OSV malware advisory MAL-2026-6068 blocks this version. swift-parse-stream advertises itself as an SVG sanitizer/minifier but ships an undocumented `getPlugin` export in index.js...
OpenSSF/OSV malware advisory MAL-2026-6066 blocks this version. The package is advertised as an SVG sanitizer but exposes an undocumented getPlugin() export whose returned function fetche...
OpenSSF/OSV malware advisory MAL-2026-6066 blocks this version. The package is advertised as an SVG sanitizer but exposes an undocumented getPlugin() export whose returned function fetche...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-5861 blocks this version. bot.js performs a hardcoded HTTPS GET to api.telegram.org's bot sendMessage endpoint, transmitting host fingerprint data co...
OpenSSF/OSV malware advisory MAL-2026-5860 blocks this version. Package masquerades as a 'Drop-in replacement for @solana/web3.js' and lists its author as 'Solana Labs Maintainers <mainta...
OpenSSF/OSV malware advisory MAL-2026-5735 blocks this version. On `npm install`, this package's postinstall hook (`node index.js`) hex-encodes the installer's current working directory,...
OpenSSF/OSV malware advisory MAL-2026-2891 blocks this version. chai-as-init is a malicious npm package that when imported downloads a C2 dropper from https://api.npoint[.]io/c2e881b8bc0f...
OpenSSF/OSV malware advisory MAL-2026-6087 blocks this version. The package's only documented function, getJogos() (default export), unconditionally invokes an internal helper named prepa...
OpenSSF/OSV malware advisory MAL-2026-5291 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...