npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 560
Updated 23 Oct 2026, 22:45 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5230 blocks this version. No concrete installer-harm signals were identified in this version of autotel-subscribers. There is no observed lifecycle s...
OpenSSF/OSV malware advisory MAL-2026-5239 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5236 blocks this version. No concrete installer-harm signals were identified in this package version. The package name combines 'awaitly' and 'libsql...
OpenSSF/OSV malware advisory MAL-2026-5237 blocks this version. No concrete installer-harm signals were identified in this package version. The package name suggests a MongoDB-related asy...
OpenSSF/OSV malware advisory MAL-2026-5238 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5223 blocks this version. Pattern-based matches fired on the strings 'ping' and 'POST' co-occurring in the package's bundled output (dist/index.cjs,...
OpenSSF/OSV malware advisory MAL-2026-5230 blocks this version. No concrete installer-harm signals were identified in this version of autotel-subscribers. There is no observed lifecycle s...
OpenSSF/OSV malware advisory MAL-2026-5223 blocks this version. Pattern-based matches fired on the strings 'ping' and 'POST' co-occurring in the package's bundled output (dist/index.cjs,...
OpenSSF/OSV malware advisory MAL-2026-5239 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5238 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5236 blocks this version. No concrete installer-harm signals were identified in this package version. The package name combines 'awaitly' and 'libsql...
OpenSSF/OSV malware advisory MAL-2026-5237 blocks this version. No concrete installer-harm signals were identified in this package version. The package name suggests a MongoDB-related asy...
OpenSSF/OSV malware advisory MAL-2026-5230 blocks this version. No concrete installer-harm signals were identified in this version of autotel-subscribers. There is no observed lifecycle s...
OpenSSF/OSV malware advisory MAL-2026-5223 blocks this version. Pattern-based matches fired on the strings 'ping' and 'POST' co-occurring in the package's bundled output (dist/index.cjs,...
OpenSSF/OSV malware advisory MAL-2026-5230 blocks this version. No concrete installer-harm signals were identified in this version of autotel-subscribers. There is no observed lifecycle s...
OpenSSF/OSV malware advisory MAL-2026-5239 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5238 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5237 blocks this version. No concrete installer-harm signals were identified in this package version. The package name suggests a MongoDB-related asy...
OpenSSF/OSV malware advisory MAL-2026-5236 blocks this version. No concrete installer-harm signals were identified in this package version. The package name combines 'awaitly' and 'libsql...
OpenSSF/OSV malware advisory MAL-2026-5223 blocks this version. Pattern-based matches fired on the strings 'ping' and 'POST' co-occurring in the package's bundled output (dist/index.cjs,...
OpenSSF/OSV malware advisory MAL-2026-5230 blocks this version. No concrete installer-harm signals were identified in this version of autotel-subscribers. There is no observed lifecycle s...
OpenSSF/OSV malware advisory MAL-2026-5223 blocks this version. Pattern-based matches fired on the strings 'ping' and 'POST' co-occurring in the package's bundled output (dist/index.cjs,...
OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...
OpenSSF/OSV malware advisory MAL-2026-5239 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5238 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code