npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 587
Updated 24 Oct 2026, 14:32 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4507 blocks this version. Package name mimics Coinbase's internal `cb-wallet-*` namespace to capture dependency-confusion resolutions. On `npm instal...
OpenSSF/OSV malware advisory MAL-2026-4506 blocks this version. Package name 'cb-wallet-data' targets a presumed Coinbase-internal namespace and is published by an unaffiliated party. Bot...
OpenSSF/OSV malware advisory MAL-2026-4740 blocks this version. The package is published as 'zod-to-js' but ships a copy of pino's source tree (main entry `pino.js`, lib/proto.js, lib/lev...
OpenSSF/OSV malware advisory MAL-2026-4501 blocks this version. The package presents itself as a clone of juliangruber/balanced-match (stolen author identity 'Julian Gruber <mail@juliangr...
OpenSSF/OSV malware advisory MAL-2026-4501 blocks this version. The package presents itself as a clone of juliangruber/balanced-match (stolen author identity 'Julian Gruber <mail@juliangr...
OpenSSF/OSV malware advisory MAL-2026-4655 blocks this version. The package's `install` lifecycle script (`node index.js`) and its main entry both load `lib/core.js`, which reads `os.user...
OpenSSF/OSV malware advisory MAL-2026-4655 blocks this version. The package's `install` lifecycle script (`node index.js`) and its main entry both load `lib/core.js`, which reads `os.user...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-4740 blocks this version. The package is published as 'zod-to-js' but ships a copy of pino's source tree (main entry `pino.js`, lib/proto.js, lib/lev...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4503 blocks this version. The package masquerades as a pino-like logging middleware (README is copied from pino, exports a `pino` property, mimics pi...
OpenSSF/OSV malware advisory MAL-2026-3774 blocks this version. The package masquerades as a TypeScript helper library (README is lifted from Microsoft's tslib and references --importHelp...
OpenSSF/OSV malware advisory MAL-2026-3774 blocks this version. The package masquerades as a TypeScript helper library (README is lifted from Microsoft's tslib and references --importHelp...
OpenSSF/OSV malware advisory MAL-2026-3775 blocks this version. Package name 'tsliverhome' impersonates the widely-used 'tslib' package (~300M weekly downloads). The shipped README.md is...
OpenSSF/OSV malware advisory MAL-2026-3769 blocks this version. Package impersonates the popular `prettier` formatter — README and description are copied verbatim from the real Prettier p...
OpenSSF/OSV malware advisory MAL-2026-3769 blocks this version. Package impersonates the popular `prettier` formatter — README and description are copied verbatim from the real Prettier p...
OpenSSF/OSV malware advisory MAL-2026-3775 blocks this version. Package name 'tsliverhome' impersonates the widely-used 'tslib' package (~300M weekly downloads). The shipped README.md is...
OpenSSF/OSV malware advisory MAL-2026-3775 blocks this version. Package name 'tsliverhome' impersonates the widely-used 'tslib' package (~300M weekly downloads). The shipped README.md is...
OpenSSF/OSV malware advisory MAL-2026-3770 blocks this version. prisma-callback@1.0.3 is a name-confusion package against the genuine `prisma` ORM. Its `package.json` declares `"preinstal...
OpenSSF/OSV malware advisory MAL-2026-3770 blocks this version. prisma-callback@1.0.3 is a name-confusion package against the genuine `prisma` ORM. Its `package.json` declares `"preinstal...
OpenSSF/OSV malware advisory MAL-2026-3770 blocks this version. prisma-callback@1.0.3 is a name-confusion package against the genuine `prisma` ORM. Its `package.json` declares `"preinstal...
OpenSSF/OSV malware advisory MAL-2026-3775 blocks this version. Package name 'tsliverhome' impersonates the widely-used 'tslib' package (~300M weekly downloads). The shipped README.md is...
OpenSSF/OSV malware advisory MAL-2026-3770 blocks this version. prisma-callback@1.0.3 is a name-confusion package against the genuine `prisma` ORM. Its `package.json` declares `"preinstal...
OpenSSF/OSV malware advisory MAL-2026-3724 blocks this version. On `npm install`, the package's `preinstall.js` collects `os.hostname()` and `os.userInfo().username` and sends them as que...
OpenSSF/OSV malware advisory MAL-2026-3724 blocks this version. On `npm install`, the package's `preinstall.js` collects `os.hostname()` and `os.userInfo().username` and sends them as que...