npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 572
Updated 24 Oct 2026, 06:28 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...
OpenSSF/OSV malware advisory MAL-2026-5648 blocks this version. On `npm install`, the package's postinstall.js collects `os.hostname()` and `os.userInfo().username` and embeds them as que...
OpenSSF/OSV malware advisory MAL-2026-5648 blocks this version. On `npm install`, the package's postinstall.js collects `os.hostname()` and `os.userInfo().username` and embeds them as que...
OpenSSF/OSV malware advisory MAL-2026-5648 blocks this version. On `npm install`, the package's postinstall.js collects `os.hostname()` and `os.userInfo().username` and embeds them as que...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-5153 blocks this version. Package @att-ebiz/abs-components-bc@99.9.1 is an empty placeholder published to public npm under a scope (@att-ebiz) that m...
OpenSSF/OSV malware advisory MAL-2026-5884 blocks this version. On `npm install`, the `preinstall` hook (`node lib/setup.js`) runs on Windows and invokes `lib/worker.js`, which downloads...
OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...
OpenSSF/OSV malware advisory MAL-2026-5150 blocks this version. On `npm install`, the package's preinstall script (preinstall.js) collects the installer's hostname, OS username, current w...
OpenSSF/OSV malware advisory MAL-2026-6192 blocks this version. nodepathbalance54 exports a single function (`nodeaxionweb`) whose implementation is hidden inside a hand-rolled stack-base...
OpenSSF/OSV malware advisory MAL-2026-5972 blocks this version. On `npm install`, the package's postinstall lifecycle script (postinstall.js) collects installer-side host identifiers — os...
OpenSSF/OSV malware advisory MAL-2026-5900 blocks this version. Package name `chai-as-decrypted` mimics the popular `chai-as-promised`, and the README impersonates `pino` (uses pino's npm...
OpenSSF/OSV malware advisory MAL-2026-2891 blocks this version. chai-as-init is a malicious npm package that when imported downloads a C2 dropper from https://api.npoint[.]io/c2e881b8bc0f...
OpenSSF/OSV malware advisory MAL-2026-2509 blocks this version. Package collects and sends sensitive system info to a hardcoded server. The package masquerades as a LangGraph JS utility b...
OpenSSF/OSV malware advisory MAL-2026-5753 blocks this version. Package advertises trivial form-validation helpers (notEmpty/isEmail/isPhone/maxLen/minLen) but on require/import of the ma...
OpenSSF/OSV malware advisory MAL-2026-5139 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5140 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5133 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5142 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5141 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5145 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5146 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5148 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5144 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5143 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...