npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 555
Updated 23 Oct 2026, 19:35 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5629 blocks this version. The package name `sass-formats` is one character-edit away from the popular `sass-formatter` package and reuses its origina...
OpenSSF/OSV malware advisory MAL-2026-5629 blocks this version. The package name `sass-formats` is one character-edit away from the popular `sass-formatter` package and reuses its origina...
OpenSSF/OSV malware advisory MAL-2026-6275 blocks this version. The published tarball's dist/index.js contains an obfuscated payload that runs at require() time inside a setTimeout-wrappe...
OpenSSF/OSV malware advisory MAL-2026-4699 blocks this version. Package metadata advertises 'utility mf' with main 'index.js', but the shipped main is a 15.7MB obfuscator.io-style blob pr...
OpenSSF/OSV malware advisory MAL-2026-5208 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5206 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5203 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5197 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-6078 blocks this version. pino-slite impersonates the legitimate `pino` logger (README titled 'pino-slite (Pino)' with badges and homepage pointing t...
OpenSSF/OSV malware advisory MAL-2026-5564 blocks this version. @tonsdk/core impersonates the legitimate @ton/core TON blockchain SDK. On `npm install`, scripts/postinstall.js executes au...
OpenSSF/OSV malware advisory MAL-2026-6078 blocks this version. pino-slite impersonates the legitimate `pino` logger (README titled 'pino-slite (Pino)' with badges and homepage pointing t...
OpenSSF/OSV malware advisory MAL-2026-2929 blocks this version. On require(), path.js runs an IIFE that calls a loader which fetches a base64-hidden URL (https://www.jsonkeeper.com/b/XTTB...
OpenSSF/OSV malware advisory MAL-2026-5346 blocks this version. Package name and README impersonate the well-known `cookie-parser` Express middleware. The source is a near-verbatim copy o...
OpenSSF/OSV malware advisory MAL-2026-5346 blocks this version. Package name and README impersonate the well-known `cookie-parser` Express middleware. The source is a near-verbatim copy o...
OpenSSF/OSV malware advisory MAL-2026-5206 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5208 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5242 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5242 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5243 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5259 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5240 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5244 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5244 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5259 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5240 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code