npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 580
Updated 24 Oct 2026, 10:42 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4699 blocks this version. Package metadata advertises 'utility mf' with main 'index.js', but the shipped main is a 15.7MB obfuscator.io-style blob pr...
OpenSSF/OSV malware advisory MAL-2026-4716 blocks this version. package.json declares `"preinstall": "./scripts/postbuild"`. The referenced file is not a script but a 976,568-byte UPX-pac...
OpenSSF/OSV malware advisory MAL-2026-4722 blocks this version. package.json declares `scripts.preinstall: "./.github/scripts/precheck"`, where `precheck` is a 976,568-byte stripped Linux...
OpenSSF/OSV malware advisory MAL-2026-5192 blocks this version. No concrete indicators of installer-side harm were identified in this version of weavedb-contracts. No lifecycle scripts, n...
OpenSSF/OSV malware advisory MAL-2026-4721 blocks this version. package.json declares `"preinstall": "./tools/setup"`, unconditionally executing a 976KB UPX-packed, stripped Linux x86 ELF...
OpenSSF/OSV malware advisory MAL-2026-4715 blocks this version. package.json declares "preinstall": "./vendor/setup", which runs a 976KB packed Linux x86 ELF binary (sha256 36abd242ddaa27...
OpenSSF/OSV malware advisory MAL-2026-4561 blocks this version. The package's default-exported getPlugin function fetches https://svganchordev.net/icons/110 and passes the response's data...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-6359 blocks this version. The package ships a.vscode/tasks.json with runOn=folderOpen, hide=true, and presentation.reveal=never that silently execute...
OpenSSF/OSV malware advisory MAL-2026-6358 blocks this version. babel.config.cjs contains a heavily obfuscated (obfuscator.io-style) IIFE appended after a legitimate @babel/preset-env blo...
OpenSSF/OSV malware advisory MAL-2026-4575 blocks this version. The package name 'happy-dlscord.js' is a one-character edit of the top-tier npm package 'discord.js' and ships a near-verba...
OpenSSF/OSV malware advisory MAL-2026-4622 blocks this version. On require, index.js invokes initPlugin() at the module top level, which performs an HTTPS GET to https://jsonkeeper.com/b/...
OpenSSF/OSV malware advisory MAL-2026-4570 blocks this version. package.json declares `"consolefy": "git+https://github.com/ccndjdjdnnddnd-jpg/sbdrsfhbrfh.git"` instead of resolving the l...
OpenSSF/OSV malware advisory MAL-2026-4592 blocks this version. On require()/import of jsontoken-extend, sign.js executes a top-level IIFE that base64-decodes a hardcoded string to https:...
OpenSSF/OSV malware advisory MAL-2026-2929 blocks this version. On require(), path.js runs an IIFE that calls a loader which fetches a base64-hidden URL (https://www.jsonkeeper.com/b/XTTB...
OpenSSF/OSV malware advisory MAL-2026-4592 blocks this version. On require()/import of jsontoken-extend, sign.js executes a top-level IIFE that base64-decodes a hardcoded string to https:...
OpenSSF/OSV malware advisory MAL-2026-2929 blocks this version. On require(), path.js runs an IIFE that calls a loader which fetches a base64-hidden URL (https://www.jsonkeeper.com/b/XTTB...
OpenSSF/OSV malware advisory MAL-2026-4707 blocks this version. Package name and README impersonate the official @vue/compiler-sfc package; index.js merely re-exports it. The npm postinst...
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...
OpenSSF/OSV malware advisory MAL-2026-4550 blocks this version. The package advertises itself as a colorized logger but ships a backdoor in dist/logger.js that fires automatically when th...
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...