npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 584
Updated 24 Oct 2026, 12:56 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4699 blocks this version. Package metadata advertises 'utility mf' with main 'index.js', but the shipped main is a 15.7MB obfuscator.io-style blob pr...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-4393 blocks this version. Package name impersonates the well-known `libsignal-node` Signal Protocol library and ships a verbatim copy of its README,...
OpenSSF/OSV malware advisory MAL-2026-4336 blocks this version. package.json declares both `preinstall` and `postinstall` hooks that execute `index.js`, which exfiltrates installer data t...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...
OpenSSF/OSV malware advisory MAL-2026-4699 blocks this version. Package metadata advertises 'utility mf' with main 'index.js', but the shipped main is a 15.7MB obfuscator.io-style blob pr...
OpenSSF/OSV malware advisory MAL-2026-4212 blocks this version. A coordinated supply-chain attack comprising 9 npm packages published by maintainer `polymarketdev` (GitHub actor `texselli...
OpenSSF/OSV malware advisory MAL-2026-4215 blocks this version. A coordinated supply-chain attack comprising 9 npm packages published by maintainer `polymarketdev` (GitHub actor `texselli...
OpenSSF/OSV malware advisory MAL-2026-4213 blocks this version. A coordinated supply-chain attack comprising 9 npm packages published by maintainer `polymarketdev` (GitHub actor `texselli...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4642 blocks this version. The package presents a Polygon/Polymarket validation/crypto utility but its exported APIs silently relay caller data to a h...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...