npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 558
Updated 23 Oct 2026, 21:27 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6212 blocks this version. The package advertises itself as a tiny environment-variable validator but ships lib/preflight.js, a heavily obfuscated (ob...
OpenSSF/OSV malware advisory MAL-2026-6210 blocks this version. @apexcraft/nano-key advertises itself as a 12-byte sortable ID generator (README and repository metadata are copied from yi...
OpenSSF/OSV malware advisory MAL-2026-6210 blocks this version. @apexcraft/nano-key advertises itself as a 12-byte sortable ID generator (README and repository metadata are copied from yi...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-4699 blocks this version. Package metadata advertises 'utility mf' with main 'index.js', but the shipped main is a 15.7MB obfuscator.io-style blob pr...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4699 blocks this version. Package metadata advertises 'utility mf' with main 'index.js', but the shipped main is a 15.7MB obfuscator.io-style blob pr...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-5237 blocks this version. No concrete installer-harm signals were identified in this package version. The package name suggests a MongoDB-related asy...
OpenSSF/OSV malware advisory MAL-2026-5238 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5237 blocks this version. No concrete installer-harm signals were identified in this package version. The package name suggests a MongoDB-related asy...
OpenSSF/OSV malware advisory MAL-2026-5238 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5236 blocks this version. No concrete installer-harm signals were identified in this package version. The package name combines 'awaitly' and 'libsql...
OpenSSF/OSV malware advisory MAL-2026-5230 blocks this version. No concrete installer-harm signals were identified in this version of autotel-subscribers. There is no observed lifecycle s...
OpenSSF/OSV malware advisory MAL-2026-5239 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5238 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5237 blocks this version. No concrete installer-harm signals were identified in this package version. The package name suggests a MongoDB-related asy...
OpenSSF/OSV malware advisory MAL-2026-5236 blocks this version. No concrete installer-harm signals were identified in this package version. The package name combines 'awaitly' and 'libsql...
OpenSSF/OSV malware advisory MAL-2026-5230 blocks this version. No concrete installer-harm signals were identified in this version of autotel-subscribers. There is no observed lifecycle s...
OpenSSF/OSV malware advisory MAL-2026-5230 blocks this version. No concrete installer-harm signals were identified in this version of autotel-subscribers. There is no observed lifecycle s...
OpenSSF/OSV malware advisory MAL-2026-5239 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5238 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5236 blocks this version. No concrete installer-harm signals were identified in this package version. The package name combines 'awaitly' and 'libsql...
OpenSSF/OSV malware advisory MAL-2026-5237 blocks this version. No concrete installer-harm signals were identified in this package version. The package name suggests a MongoDB-related asy...