npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 569
Updated 24 Oct 2026, 05:01 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5251 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5217 blocks this version. No concrete indicators of installer-side harm were identified for autotel-cloudflare@2.18.16. No lifecycle scripts fetching...
OpenSSF/OSV malware advisory MAL-2026-5223 blocks this version. Pattern-based matches fired on the strings 'ping' and 'POST' co-occurring in the package's bundled output (dist/index.cjs,...
OpenSSF/OSV malware advisory MAL-2026-5253 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5255 blocks this version. executable-stories-mcp@0.3.3 ships a bundled HTTP server module (dist/http.cjs and dist/http.js) where pattern matchers fla...
OpenSSF/OSV malware advisory MAL-2026-5258 blocks this version. No concrete installer-harm indicators were identified in this package version. No lifecycle-script behavior, network beacon...
OpenSSF/OSV malware advisory MAL-2026-5226 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5228 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5225 blocks this version. No concrete installer-harm evidence was identified in this version of autotel-mongoose. The package name resembles the popu...
OpenSSF/OSV malware advisory MAL-2026-5220 blocks this version. No concrete installer-harm signals were identified in this package version. No lifecycle hooks, hardcoded exfiltration endp...
OpenSSF/OSV malware advisory MAL-2026-5212 blocks this version. No concrete installer-harm evidence was identified for autotel-adapters@0.3.5. No lifecycle-script droppers, hardcoded exfi...
OpenSSF/OSV malware advisory MAL-2026-5221 blocks this version. No concrete installer-harm evidence was identified for this package version. No lifecycle-script droppers, credential reads...
OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...
OpenSSF/OSV malware advisory MAL-2026-5218 blocks this version. autotel-devtools ships bundled CommonJS and ESM artifacts (dist/cli.cjs, dist/cli.js, dist/index.cjs, dist/index.js, dist/s...
OpenSSF/OSV malware advisory MAL-2026-5224 blocks this version. No concrete installer-harm signals were identified for this package version. No lifecycle hooks, network destinations, cred...
OpenSSF/OSV malware advisory MAL-2026-5233 blocks this version. No concrete installer-harm signals were identified for this package version. Coverage of the package contents was partial,...
OpenSSF/OSV malware advisory MAL-2026-5215 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5210 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5210 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5227 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5219 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5225 blocks this version. No concrete installer-harm evidence was identified in this version of autotel-mongoose. The package name resembles the popu...
OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...
OpenSSF/OSV malware advisory MAL-2026-5216 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5213 blocks this version. The Miasma malware is a self-propagating worm that spreads across the npm registry by abusing weaponized `binding.gyp` file...