npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 588
Updated 24 Oct 2026, 15:06 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3771 blocks this version. request-logger-canary@1.0.0 ships a preinstall.js that, when `npm install` runs, opens a TCP socket to 52.74.242.200:8851 a...
OpenSSF/OSV malware advisory MAL-2026-3750 blocks this version. On require()/import, index.js runs an IIFE that POSTs a getAccountInfo RPC call to https://api.devnet.solana.com for Solana...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-3713 blocks this version. hardhat-core version 2.1.2 spawns a detached Node.js child process from index.js that runs lib/caller.js. The child decodes...
OpenSSF/OSV malware advisory MAL-2026-3777 blocks this version. Full C2 implant disguised as vue-template-compiler fork. postinstall-run.cjs loads tooling-bootstrap.cjs which contains bas...
OpenSSF/OSV malware advisory MAL-2026-3653 blocks this version. Package `@design-system-coopeuch/web@999.0.4` is a dependency-confusion squat of an internal-looking scope, published at an...
OpenSSF/OSV malware advisory MAL-2026-3653 blocks this version. Package `@design-system-coopeuch/web@999.0.4` is a dependency-confusion squat of an internal-looking scope, published at an...
OpenSSF/OSV malware advisory MAL-2026-3462 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3462 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3312 blocks this version. On require(), path.js executes an IIFE that calls loadTokenData(), which fetches a base64-obfuscated URL (decoding to https...
OpenSSF/OSV malware advisory MAL-2026-3028 blocks this version. npm stealer. Hardcoded Discord webhook id 1497047226428690432 in postinstall Folder/bin/S.js. Exfils {hostname, whoami, pwd...
OpenSSF/OSV malware advisory MAL-2026-2929 blocks this version. On require(), path.js runs an IIFE that calls a loader which fetches a base64-hidden URL (https://www.jsonkeeper.com/b/XTTB...
OpenSSF/OSV malware advisory MAL-2026-2446 blocks this version. index.js uses child_process to execute `whoami` and gather `hostname` information, then transmits results via https.get to...
OpenSSF/OSV malware advisory MAL-2026-2446 blocks this version. index.js uses child_process to execute `whoami` and gather `hostname` information, then transmits results via https.get to...
OpenSSF/OSV malware advisory MAL-2026-2407 blocks this version. Malicious package due to code obfuscation, dynamic module loading, process exposure, suspicious install script, and untrust...
OpenSSF/OSV malware advisory MAL-2026-2350 blocks this version. Package impersonates the popular `dotenv` package: `package.json` points its repository field to `git://github.com/motdotla...
OpenSSF/OSV malware advisory MAL-2025-47594 blocks this version. The package communicates with a domain associated with malicious activity.
OpenSSF/OSV malware advisory MAL-2025-41443 blocks this version. ## Summary
OpenSSF/OSV malware advisory MAL-2025-41443 blocks this version. ## Summary
OpenSSF/OSV malware advisory MAL-2025-41443 blocks this version. ## Summary
OpenSSF/OSV malware advisory MAL-2025-41443 blocks this version. ## Summary
OpenSSF/OSV malware advisory MAL-2025-41443 blocks this version. ## Summary
OpenSSF/OSV malware advisory MAL-2025-41443 blocks this version. ## Summary
OpenSSF/OSV malware advisory MAL-2025-41442 blocks this version. ## Summary
OpenSSF/OSV malware advisory MAL-2025-41439 blocks this version. ## Summary