npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 582
Updated 24 Oct 2026, 11:50 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-4336 blocks this version. package.json declares both `preinstall` and `postinstall` hooks that execute `index.js`, which exfiltrates installer data t...
OpenSSF/OSV malware advisory MAL-2026-4336 blocks this version. package.json declares both `preinstall` and `postinstall` hooks that execute `index.js`, which exfiltrates installer data t...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-4258 blocks this version. All three lifecycle hooks (preinstall, install, postinstall) in package.json invoke `node telemetry.js`, so the payload fir...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-4556 blocks this version. Package name mimics the legitimate `express-enrouten` route-discovery library, but the shipped `index.js` only hardcodes tw...
OpenSSF/OSV malware advisory MAL-2026-4556 blocks this version. Package name mimics the legitimate `express-enrouten` route-discovery library, but the shipped `index.js` only hardcodes tw...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-4508 blocks this version. The package contains code in dist/entry.js and dist/index.js that invokes `npm publish` programmatically combined with `wri...
OpenSSF/OSV malware advisory MAL-2026-4677 blocks this version. On `npm install`, swift-optimizer@1.1.0 runs scripts/install-binary.js as a postinstall hook. The script is a hand-rolled J...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-4252 blocks this version. On npm install, the package's preinstall, install, and postinstall lifecycle hooks all invoke telemetry.js, which collects...