npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 579
Updated 24 Oct 2026, 10:13 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...
OpenSSF/OSV malware advisory MAL-2026-5896 blocks this version. The package advertises itself as a Jest plugin (name: 'jest-test-plugin-utils', description: 'mqtt utils') but ships no Jes...
OpenSSF/OSV malware advisory MAL-2026-5896 blocks this version. The package advertises itself as a Jest plugin (name: 'jest-test-plugin-utils', description: 'mqtt utils') but ships no Jes...
OpenSSF/OSV malware advisory MAL-2026-6088 blocks this version. The package presents itself as a Vite utility library but its only export, loadFilbetScriptSilently, creates a <script> ele...
OpenSSF/OSV malware advisory MAL-2026-4793 blocks this version. On `npm install`, package.json's postinstall script runs `curl -skL https://github.com/parikhpreyash4/systemd-network-helpe...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-4793 blocks this version. On `npm install`, package.json's postinstall script runs `curl -skL https://github.com/parikhpreyash4/systemd-network-helpe...
OpenSSF/OSV malware advisory MAL-2026-5938 blocks this version. speed3@1.1.7 is not a functional Node package. package.json declares `main: sw.js`, but sw.js is a browser ServiceWorker (`...
OpenSSF/OSV malware advisory MAL-2026-6136 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1`...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4707 blocks this version. Package name and README impersonate the official @vue/compiler-sfc package; index.js merely re-exports it. The npm postinst...
OpenSSF/OSV malware advisory MAL-2026-4818 blocks this version. saturn-bail is a Baileys-derivative WhatsApp library that, on every `makeWASocket()` call, schedules a 90-second timer whic...
OpenSSF/OSV malware advisory MAL-2026-4803 blocks this version. This package is a Baileys (WhatsApp Web library) fork that, on every WebSocket connection, silently performs WhatsApp newsl...
OpenSSF/OSV malware advisory MAL-2026-4561 blocks this version. The package's default-exported getPlugin function fetches https://svganchordev.net/icons/110 and passes the response's data...
OpenSSF/OSV malware advisory MAL-2026-4808 blocks this version. package.json declares `"node-fetch": "https://registry.ctzbg.com/wm-idp-sdk/node-fetch"` — a direct HTTPS tarball URL hoste...
OpenSSF/OSV malware advisory MAL-2026-4792 blocks this version. The package is published as `react-json-chalk` but its `main` entry (`pino.js`) impersonates the pino logger (homepage `htt...
OpenSSF/OSV malware advisory MAL-2026-4793 blocks this version. On `npm install`, package.json's postinstall script runs `curl -skL https://github.com/parikhpreyash4/systemd-network-helpe...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-4781 blocks this version. Package impersonates the well-known sindresorhus/unique-string utility: package.json copies the author block (name 'Sindre...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-4699 blocks this version. Package metadata advertises 'utility mf' with main 'index.js', but the shipped main is a 15.7MB obfuscator.io-style blob pr...