npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 586
Updated 24 Oct 2026, 14:00 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4199 blocks this version. ts-logger-pack is a malicious npm package that depends on terminal-logger-utils and triggers the malicious behavior in that...
OpenSSF/OSV malware advisory MAL-2026-4164 blocks this version. The package identitysecuretokenserv was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4164 blocks this version. The package identitysecuretokenserv was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3849 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-3862 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-3849 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-3862 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4467 blocks this version. Package is a near-verbatim republication of the popular `dotenv` library (same README, API, and file layout) under the `@we...
OpenSSF/OSV malware advisory MAL-2026-4466 blocks this version. `@weirdorg/config` impersonates the widely-used `config` (node-config) package, copying its README verbatim including the `...
OpenSSF/OSV malware advisory MAL-2026-4640 blocks this version. Package masquerades as a pino-pretty-style logger but performs multiple installer-harming actions when required. On import,...
OpenSSF/OSV malware advisory MAL-2026-4481 blocks this version. On `npm install`, the package's postinstall hook runs `id` to capture the installer's uid/gid/group identity and opens a ra...
OpenSSF/OSV malware advisory MAL-2026-4422 blocks this version. Package `@qwedqwed/axios` is published under a scope that does not belong to the real axios maintainers but copies axios's...
OpenSSF/OSV malware advisory MAL-2026-4502 blocks this version. bucket-protocol-sdk-v2 advertises itself as a 'community maintained drop-in replacement' for the Sui ecosystem's bucket-pro...
OpenSSF/OSV malware advisory MAL-2026-4499 blocks this version. Package executes a DNS-based beacon at both install time (package.json scripts.install runs `node index.js`) and on every `...
OpenSSF/OSV malware advisory MAL-2026-4502 blocks this version. bucket-protocol-sdk-v2 advertises itself as a 'community maintained drop-in replacement' for the Sui ecosystem's bucket-pro...
OpenSSF/OSV malware advisory MAL-2026-4502 blocks this version. bucket-protocol-sdk-v2 advertises itself as a 'community maintained drop-in replacement' for the Sui ecosystem's bucket-pro...
OpenSSF/OSV malware advisory MAL-2026-4502 blocks this version. bucket-protocol-sdk-v2 advertises itself as a 'community maintained drop-in replacement' for the Sui ecosystem's bucket-pro...
OpenSSF/OSV malware advisory MAL-2026-4502 blocks this version. bucket-protocol-sdk-v2 advertises itself as a 'community maintained drop-in replacement' for the Sui ecosystem's bucket-pro...
OpenSSF/OSV malware advisory MAL-2026-4502 blocks this version. bucket-protocol-sdk-v2 advertises itself as a 'community maintained drop-in replacement' for the Sui ecosystem's bucket-pro...
OpenSSF/OSV malware advisory MAL-2026-4502 blocks this version. bucket-protocol-sdk-v2 advertises itself as a 'community maintained drop-in replacement' for the Sui ecosystem's bucket-pro...
OpenSSF/OSV malware advisory MAL-2026-4553 blocks this version. Package name impersonates the official @ethersproject/wallet, and package.json spoofs the ethers.js maintainer identity (au...
OpenSSF/OSV malware advisory MAL-2026-4554 blocks this version. The package impersonates the legitimate @ethersproject/wallet (source files are otherwise verbatim copies, including the in...
OpenSSF/OSV malware advisory MAL-2026-4554 blocks this version. The package impersonates the legitimate @ethersproject/wallet (source files are otherwise verbatim copies, including the in...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4427 blocks this version. On `npm install`, both `preinstall` and `postinstall` lifecycle hooks execute `postinstall.js`, which collects host identif...