npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 571
Updated 24 Oct 2026, 06:01 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...
OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...
OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...
OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...
OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...
OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...
OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...
OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...
OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...
OpenSSF/OSV malware advisory MAL-2026-5163 blocks this version. Part of a coordinated multi-package supply-chain attack impersonating EMCD (emcd.io), a legitimate Russian cryptocurrency e...
OpenSSF/OSV malware advisory MAL-2026-5994 blocks this version. The package impersonates the pino logger (README titled 'chai-mocks', badges linking to pinojs/pino, module export named `p...
OpenSSF/OSV malware advisory MAL-2026-5611 blocks this version. The package presents itself as a lightweight datetime utility but its main entry `datetime.js` invokes `collect()` from `./...
OpenSSF/OSV malware advisory MAL-2026-5611 blocks this version. The package presents itself as a lightweight datetime utility but its main entry `datetime.js` invokes `collect()` from `./...
OpenSSF/OSV malware advisory MAL-2026-5741 blocks this version. package.json declares scripts.postinstall = `node postinstall.js`. On every `npm install`, postinstall.js runs `execSync('i...
OpenSSF/OSV malware advisory MAL-2026-5741 blocks this version. package.json declares scripts.postinstall = `node postinstall.js`. On every `npm install`, postinstall.js runs `execSync('i...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-5901 blocks this version. Package name is a one-edit typosquat of the widely-used chai-as-promised, but the shipped code is unrelated to chai. The ex...
OpenSSF/OSV malware advisory MAL-2026-5925 blocks this version. motion-lib@2.3.5 masquerades as a pino-style logger (exports module.exports.pino, ships proto.js/multistream.js/transport.j...
OpenSSF/OSV malware advisory MAL-2026-5606 blocks this version. chai-dec impersonates the chai/pino ecosystem (package name rides on chai; package.json keywords and exports — `module.expo...
OpenSSF/OSV malware advisory MAL-2026-5172 blocks this version. package.json declares scripts.preinstall = 'node index.js', which runs automatically on npm install. index.js collects host...
OpenSSF/OSV malware advisory MAL-2026-5734 blocks this version. node-denv presents itself as a pino-compatible logging middleware (index.js exports `module.exports.pino = middleware` and...
OpenSSF/OSV malware advisory MAL-2026-5908 blocks this version. chain-chai-test@1.3.5 advertises itself as a pino-style logger (keywords fast/logger/stream/json, exported alias module.exp...
OpenSSF/OSV malware advisory MAL-2026-5158 blocks this version. page-info-service@99.9.1 ships an empty stub (`index.js` is `module.exports = {}`) with placeholder author/description meta...
OpenSSF/OSV malware advisory MAL-2026-5166 blocks this version. package.json declares a dependency `ltidisafe` resolved directly from a raw tarball URL on a generic Google Cloud Storage b...
OpenSSF/OSV malware advisory MAL-2026-5159 blocks this version. po-ops-local-dev@99.9.1 has no functional code of its own (index.js contains only `module.exports = {};` and there are no l...