npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 590
Updated 24 Oct 2026, 16:09 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3710 blocks this version. The OpenSSF Package Analysis project identified 'ethers-logger' @ 1.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-3709 blocks this version. The OpenSSF Package Analysis project identified 'ethers-json-wallet' @ 1.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-3707 blocks this version. package.json declares a postinstall hook that base64-decodes the URL http://8.217.75.147:3000/payload, fetches it via curl...
OpenSSF/OSV malware advisory MAL-2026-3707 blocks this version. package.json declares a postinstall hook that base64-decodes the URL http://8.217.75.147:3000/payload, fetches it via curl...
OpenSSF/OSV malware advisory MAL-2026-3708 blocks this version. The package's `package.json` declares a `postinstall` script that base64-decodes a hidden URL (`http://8.217.75.147:3000/pa...
OpenSSF/OSV malware advisory MAL-2026-3708 blocks this version. The package's `package.json` declares a `postinstall` script that base64-decodes a hidden URL (`http://8.217.75.147:3000/pa...
OpenSSF/OSV malware advisory MAL-2026-3760 blocks this version. On `npm install`, the package's postinstall hook spawns a Node one-liner that uses child_process.exec to curl/wget `https:/...
OpenSSF/OSV malware advisory MAL-2026-4240 blocks this version. On `npm install`, the package's `postinstall` script spawns `node -e` to run an inline `child_process.execSync` that curls...
OpenSSF/OSV malware advisory MAL-2026-4239 blocks this version. package.json declares a postinstall script that performs an HTTPS GET to an ephemeral pinggy-free.link tunnel URL (rqnyz-26...
OpenSSF/OSV malware advisory MAL-2026-6202 blocks this version. index.js line 144 contains `require('chai-assert-kit')` appended after the module's normal exports, with no other reference...
OpenSSF/OSV malware advisory MAL-2026-4779 blocks this version. Package name 'ether-bn.js' resembles the widely-used 'bn.js' big-number library, and the README directs users to install ye...
OpenSSF/OSV malware advisory MAL-2026-4779 blocks this version. Package name 'ether-bn.js' resembles the widely-used 'bn.js' big-number library, and the README directs users to install ye...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...