npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 574
Updated 24 Oct 2026, 07:29 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5147 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5142 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5133 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5148 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5145 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5141 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5146 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5138 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5135 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5144 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5136 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5137 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5126 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5140 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5139 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5143 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5134 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5147 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5119 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5730 blocks this version. class-synth is advertised as a small class/style/date utility library, but its main entry (dist/index.js) contains a hidden...
OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-5164 blocks this version. Part of a coordinated multi-package supply-chain attack impersonating EMCD (emcd.io), a legitimate Russian cryptocurrency e...
OpenSSF/OSV malware advisory MAL-2026-5165 blocks this version. Part of a coordinated multi-package supply-chain attack impersonating EMCD (emcd.io), a legitimate Russian cryptocurrency e...
OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...