npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 578
Updated 24 Oct 2026, 09:39 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5534 blocks this version. The package ships a `postinstall` lifecycle script (`sec_check.js`) that fires automatically on `npm install`. The script f...
OpenSSF/OSV malware advisory MAL-2026-5534 blocks this version. The package ships a `postinstall` lifecycle script (`sec_check.js`) that fires automatically on `npm install`. The script f...
OpenSSF/OSV malware advisory MAL-2026-5534 blocks this version. The package ships a `postinstall` lifecycle script (`sec_check.js`) that fires automatically on `npm install`. The script f...
OpenSSF/OSV malware advisory MAL-2026-5534 blocks this version. The package ships a `postinstall` lifecycle script (`sec_check.js`) that fires automatically on `npm install`. The script f...
OpenSSF/OSV malware advisory MAL-2026-6121 blocks this version. The package's main module index.js (also loaded indirectly by bin/cli.js) reads a hidden binary file lib/.perf.dat, AES-256...
OpenSSF/OSV malware advisory MAL-2026-6135 blocks this version. Package is not a library. `main` points at `sw.js`, a browser Service Worker that uses `importScripts`, `self.addEventListe...
OpenSSF/OSV malware advisory MAL-2026-6130 blocks this version. The tarball is a static-site / web-proxy build (index.html, /assets/*.js bundles with obfuscated names, a.well-known/discor...
OpenSSF/OSV malware advisory MAL-2026-6128 blocks this version. Package is published under a deceptive identity. package.json declares main=sw.js, but sw.js is a service-worker entry (imp...
OpenSSF/OSV malware advisory MAL-2026-6129 blocks this version. The tarball contains a static-site bundle (index.html, obfuscated asset chunks, service worker sw.js, and the MercuryWorksh...
OpenSSF/OSV malware advisory MAL-2026-5916 blocks this version. The tarball is not a Node library. `package.json` declares `main: sw.js` with description `"package"` and an empty author;...
OpenSSF/OSV malware advisory MAL-2026-5915 blocks this version. The package is one of approximately 100 identically-named-pattern publishes from an automated bulk-publish operation. The t...
OpenSSF/OSV malware advisory MAL-2026-5914 blocks this version. nottuff15 is one entry in a coordinated npm namespace-spam campaign. The tarball ships auto-publish.sh, a bash script that...
OpenSSF/OSV malware advisory MAL-2026-5918 blocks this version. This package is one of ~95 names in a coordinated spam-publication family (nottuff1-30, ishowfeet1-20, imillegal1-5, abuden...
OpenSSF/OSV malware advisory MAL-2026-5917 blocks this version. Package ships a Scramjet-based web proxy (sw.js service worker + bare-mux + WASM rewriter under assets/) plus a static 'Riv...
OpenSSF/OSV malware advisory MAL-2026-6484 blocks this version. The package advertises itself as a 5-line random-string generator, but index.js (the declared main) contains a hardcoded AE...
OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...
OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...
OpenSSF/OSV malware advisory MAL-2026-5534 blocks this version. The package ships a `postinstall` lifecycle script (`sec_check.js`) that fires automatically on `npm install`. The script f...
OpenSSF/OSV malware advisory MAL-2026-5534 blocks this version. The package ships a `postinstall` lifecycle script (`sec_check.js`) that fires automatically on `npm install`. The script f...
OpenSSF/OSV malware advisory MAL-2026-5835 blocks this version. On `npm install`, the package's `postinstall` hook runs `sec_check.js`, which enumerates the host's network interfaces and...
OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...
OpenSSF/OSV malware advisory MAL-2026-5896 blocks this version. The package advertises itself as a Jest plugin (name: 'jest-test-plugin-utils', description: 'mqtt utils') but ships no Jes...
OpenSSF/OSV malware advisory MAL-2026-6088 blocks this version. The package presents itself as a Vite utility library but its only export, loadFilbetScriptSilently, creates a <script> ele...
OpenSSF/OSV malware advisory MAL-2026-5896 blocks this version. The package advertises itself as a Jest plugin (name: 'jest-test-plugin-utils', description: 'mqtt utils') but ships no Jes...
OpenSSF/OSV malware advisory MAL-2026-6088 blocks this version. The package presents itself as a Vite utility library but its only export, loadFilbetScriptSilently, creates a <script> ele...