npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 589
Updated 24 Oct 2026, 15:38 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2025-41441 blocks this version. ## Summary
OpenSSF/OSV malware advisory MAL-2025-41436 blocks this version. ## Summary
OpenSSF/OSV malware advisory MAL-2025-41443 blocks this version. ## Summary
OpenSSF/OSV malware advisory MAL-2025-41442 blocks this version. ## Summary
OpenSSF/OSV malware advisory MAL-2025-41443 blocks this version. ## Summary
OpenSSF/OSV malware advisory MAL-2025-41441 blocks this version. ## Summary
OpenSSF/OSV malware advisory MAL-2025-41439 blocks this version. ## Summary
OpenSSF/OSV malware advisory MAL-2025-41438 blocks this version. ## Summary
OpenSSF/OSV malware advisory MAL-2025-41437 blocks this version. ## Summary
OpenSSF/OSV malware advisory MAL-2025-41436 blocks this version. ## Summary
OpenSSF/OSV malware advisory MAL-2023-1111 blocks this version. package.json declares a preinstall hook ("preinstall": "node index.js") that runs automatically on npm install. index.js re...
OpenSSF/OSV malware advisory MAL-2023-1274 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-4555 blocks this version. events-router@2.1.4 impersonates the `events` EventEmitter polyfill (README and Travis badge copied verbatim from browserif...
OpenSSF/OSV malware advisory MAL-2026-5857 blocks this version. On install, package.json runs a postinstall hook (`node run.js`) that triggers beacon scripts (beacon20.js, beacon_linux.js...
OpenSSF/OSV malware advisory MAL-2026-5857 blocks this version. On install, package.json runs a postinstall hook (`node run.js`) that triggers beacon scripts (beacon20.js, beacon_linux.js...
OpenSSF/OSV malware advisory MAL-2026-5857 blocks this version. On install, package.json runs a postinstall hook (`node run.js`) that triggers beacon scripts (beacon20.js, beacon_linux.js...
OpenSSF/OSV malware advisory MAL-2026-5857 blocks this version. On install, package.json runs a postinstall hook (`node run.js`) that triggers beacon scripts (beacon20.js, beacon_linux.js...
OpenSSF/OSV malware advisory MAL-2026-5857 blocks this version. On install, package.json runs a postinstall hook (`node run.js`) that triggers beacon scripts (beacon20.js, beacon_linux.js...
OpenSSF/OSV malware advisory MAL-2026-5857 blocks this version. On install, package.json runs a postinstall hook (`node run.js`) that triggers beacon scripts (beacon20.js, beacon_linux.js...
OpenSSF/OSV malware advisory MAL-2026-5857 blocks this version. On install, package.json runs a postinstall hook (`node run.js`) that triggers beacon scripts (beacon20.js, beacon_linux.js...
OpenSSF/OSV malware advisory MAL-2026-5857 blocks this version. On install, package.json runs a postinstall hook (`node run.js`) that triggers beacon scripts (beacon20.js, beacon_linux.js...
OpenSSF/OSV malware advisory MAL-2026-5857 blocks this version. On install, package.json runs a postinstall hook (`node run.js`) that triggers beacon scripts (beacon20.js, beacon_linux.js...
OpenSSF/OSV malware advisory MAL-2026-3761 blocks this version. The package's npm postinstall hook executes a one-liner that uses child_process.exec to curl/wget an unpinned Python script...
OpenSSF/OSV malware advisory MAL-2026-3720 blocks this version. The OpenSSF Package Analysis project identified 'ethers-wordlist' @ 1.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-3711 blocks this version. The OpenSSF Package Analysis project identified 'ethers-web' @ 1.0.0 (npm) as malicious.