npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 568
Updated 24 Oct 2026, 04:26 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5225 blocks this version. No concrete installer-harm evidence was identified in this version of autotel-mongoose. The package name resembles the popu...
OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...
OpenSSF/OSV malware advisory MAL-2026-5223 blocks this version. Pattern-based matches fired on the strings 'ping' and 'POST' co-occurring in the package's bundled output (dist/index.cjs,...
OpenSSF/OSV malware advisory MAL-2026-5245 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5258 blocks this version. No concrete installer-harm indicators were identified in this package version. No lifecycle-script behavior, network beacon...
OpenSSF/OSV malware advisory MAL-2026-5221 blocks this version. No concrete installer-harm evidence was identified for this package version. No lifecycle-script droppers, credential reads...
OpenSSF/OSV malware advisory MAL-2026-5247 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5218 blocks this version. autotel-devtools ships bundled CommonJS and ESM artifacts (dist/cli.cjs, dist/cli.js, dist/index.cjs, dist/index.js, dist/s...
OpenSSF/OSV malware advisory MAL-2026-5248 blocks this version. No concrete installer-harm signals were identified in this package version. No lifecycle scripts, hardcoded network destina...
OpenSSF/OSV malware advisory MAL-2026-5252 blocks this version. No concrete installer-harm indicators were identified in this version of the package. No lifecycle hooks, hardcoded network...
OpenSSF/OSV malware advisory MAL-2026-5224 blocks this version. No concrete installer-harm signals were identified for this package version. No lifecycle hooks, network destinations, cred...
OpenSSF/OSV malware advisory MAL-2026-5256 blocks this version. No concrete installer-harm signals were identified in this version. No lifecycle hooks fetching remote payloads, no credent...
OpenSSF/OSV malware advisory MAL-2026-5225 blocks this version. No concrete installer-harm evidence was identified in this version of autotel-mongoose. The package name resembles the popu...
OpenSSF/OSV malware advisory MAL-2026-5260 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5249 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5214 blocks this version. No concrete installer-harm signals were identified in this package version. No lifecycle hooks fetching external code, no c...
OpenSSF/OSV malware advisory MAL-2026-5261 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5267 blocks this version. The Miasma malware is a self-propagating worm that spreads across the npm registry by abusing weaponized `binding.gyp` file...
OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...
OpenSSF/OSV malware advisory MAL-2026-5231 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5241 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5257 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5251 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5217 blocks this version. No concrete indicators of installer-side harm were identified for autotel-cloudflare@2.18.16. No lifecycle scripts fetching...
OpenSSF/OSV malware advisory MAL-2026-5223 blocks this version. Pattern-based matches fired on the strings 'ping' and 'POST' co-occurring in the package's bundled output (dist/index.cjs,...