npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 557
Updated 23 Oct 2026, 20:49 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5572 blocks this version. Package impersonates the official SendGrid npm packages (@sendgrid/*) but ships no SDK functionality — index.js exports an...
OpenSSF/OSV malware advisory MAL-2026-5621 blocks this version. Package name `twilio-sdk` impersonates the official Twilio Node SDK (`twilio`) but ships an empty API (`module.exports = {}...
OpenSSF/OSV malware advisory MAL-2026-5572 blocks this version. Package impersonates the official SendGrid npm packages (@sendgrid/*) but ships no SDK functionality — index.js exports an...
OpenSSF/OSV malware advisory MAL-2026-5621 blocks this version. Package name `twilio-sdk` impersonates the official Twilio Node SDK (`twilio`) but ships an empty API (`module.exports = {}...
OpenSSF/OSV malware advisory MAL-2026-5572 blocks this version. Package impersonates the official SendGrid npm packages (@sendgrid/*) but ships no SDK functionality — index.js exports an...
OpenSSF/OSV malware advisory MAL-2026-5988 blocks this version. The package presents itself as 'Simplified HTTP request client' and copies identity metadata from Mikeal Rogers' legitimate...
OpenSSF/OSV malware advisory MAL-2026-5793 blocks this version. Package masquerades as an internal Swiss Post NativeScript package (name `nativescript-swisspost-pcc-creative-editor`, desc...
OpenSSF/OSV malware advisory MAL-2026-5792 blocks this version. package.json declares `preinstall: node index.js`. On `npm install`, index.js reads `process.env.INIT_CWD` (the installing...
OpenSSF/OSV malware advisory MAL-2026-4699 blocks this version. Package metadata advertises 'utility mf' with main 'index.js', but the shipped main is a 15.7MB obfuscator.io-style blob pr...
OpenSSF/OSV malware advisory MAL-2026-4699 blocks this version. Package metadata advertises 'utility mf' with main 'index.js', but the shipped main is a 15.7MB obfuscator.io-style blob pr...
OpenSSF/OSV malware advisory MAL-2026-6305 blocks this version. @frostnode/waitfor (malicious versions 0.9.0, 0.10.3, 0.10.4, and 0.10.5, published by frostnode-gk8pbf@wshu.net) is a troj...
OpenSSF/OSV malware advisory MAL-2026-6306 blocks this version. No suspicious behaviors were detected in this package. There are no lifecycle scripts performing remote fetches, no credent...
OpenSSF/OSV malware advisory MAL-2026-6304 blocks this version. No suspicious behaviors were observed in this package version. There are no install-time lifecycle hooks fetching or execut...
OpenSSF/OSV malware advisory MAL-2026-6313 blocks this version. @zynkit/jwtbytes (malicious version 0.5.3, published by zynkit-sk393b@wshu.net) is a trojanized npm package belonging to th...
OpenSSF/OSV malware advisory MAL-2026-6314 blocks this version. No concrete indicators of installer-side harm were observed in this package version. No lifecycle scripts performing remote...
OpenSSF/OSV malware advisory MAL-2026-6312 blocks this version. @tinyfox/shapecheck (malicious version 0.8.7, published by tinyfox-yjwiqz@wshu.net) is a trojanized npm package belonging t...
OpenSSF/OSV malware advisory MAL-2026-6311 blocks this version. @thymelab/logfx (malicious version 2.15.5, published by thymelab-v0et8w@wshu.net) is a trojanized npm package belonging to...
OpenSSF/OSV malware advisory MAL-2026-6310 blocks this version. @petitcode/eb-retry (malicious version 1.3.5, published by petitcode-eq1efk@wshu.net) is a trojanized npm package belonging...
OpenSSF/OSV malware advisory MAL-2026-6309 blocks this version. @nullzero/urlcat (version 1.4.2, published by nullzero-rlnozk@wshu.net) is a trojanized npm package belonging to the wshu.n...
OpenSSF/OSV malware advisory MAL-2026-6308 blocks this version. @lazyutil/dater (malicious versions 0.8.1, 0.9.2, 0.9.3, and 0.9.4, published by lazyutil-78muyg@wshu.net) is a trojanized...
OpenSSF/OSV malware advisory MAL-2026-6307 blocks this version. @glitchpad/throttler (malicious version 2.2.3, published by glitchpad-revqgz@wshu.net) is a trojanized npm package belongin...
OpenSSF/OSV malware advisory MAL-2026-6214 blocks this version. Package advertises itself as a small hex/base64/endianness codec library, but every exported encode/decode function (encode...
OpenSSF/OSV malware advisory MAL-2026-6213 blocks this version. The package advertises itself as a small in-memory pubsub library but its main entry `dist/index.js` eagerly `require()`s `...
OpenSSF/OSV malware advisory MAL-2026-6212 blocks this version. The package advertises itself as a tiny environment-variable validator but ships lib/preflight.js, a heavily obfuscated (ob...
OpenSSF/OSV malware advisory MAL-2026-6210 blocks this version. @apexcraft/nano-key advertises itself as a 12-byte sortable ID generator (README and repository metadata are copied from yi...