npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 591
Updated 24 Oct 2026, 16:48 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4557 blocks this version. The package advertises itself as a Gmail/SMTP sender library. The README documents that callers pass their SMTP `user` and...
OpenSSF/OSV malware advisory MAL-2026-4557 blocks this version. The package advertises itself as a Gmail/SMTP sender library. The README documents that callers pass their SMTP `user` and...
OpenSSF/OSV malware advisory MAL-2026-4557 blocks this version. The package advertises itself as a Gmail/SMTP sender library. The README documents that callers pass their SMTP `user` and...
OpenSSF/OSV malware advisory MAL-2026-4557 blocks this version. The package advertises itself as a Gmail/SMTP sender library. The README documents that callers pass their SMTP `user` and...
OpenSSF/OSV malware advisory MAL-2026-4557 blocks this version. The package advertises itself as a Gmail/SMTP sender library. The README documents that callers pass their SMTP `user` and...
OpenSSF/OSV malware advisory MAL-2026-4557 blocks this version. The package advertises itself as a Gmail/SMTP sender library. The README documents that callers pass their SMTP `user` and...
OpenSSF/OSV malware advisory MAL-2026-5703 blocks this version. OSV/OpenSSF confirms eslint-plugin-mistica-local-rules@19.12.11 as malicious package MAL-2026-5703. Malicious code in eslin...
OpenSSF/OSV malware advisory MAL-2026-6188 blocks this version. Package masquerades as an ESLint helper but contains code in index.js that decodes base64 blobs through Buffer.from(..., 'b...
OpenSSF/OSV malware advisory MAL-2026-6189 blocks this version. On require/run, eyee auto-executes main() (package.json sets main=cdp_inject.js and the bottom of the file invokes main() u...
OpenSSF/OSV malware advisory MAL-2026-6159 blocks this version. The npm package `expandingcards-socket-virtualization` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a dece...
OpenSSF/OSV malware advisory MAL-2026-6523 blocks this version. On module load, index.js auto-invokes initPlugin(), which HTTP-GETs https://jsonkeeper.com/b/PRA3O, parses the JSON respons...
OpenSSF/OSV malware advisory MAL-2026-3763 blocks this version. The package declares `scripts.postinstall` pointing at `postinstall.js`, which runs automatically on `npm install`. The scr...
OpenSSF/OSV malware advisory MAL-2026-3763 blocks this version. The package declares `scripts.postinstall` pointing at `postinstall.js`, which runs automatically on `npm install`. The scr...
OpenSSF/OSV malware advisory MAL-2026-3763 blocks this version. The package declares `scripts.postinstall` pointing at `postinstall.js`, which runs automatically on `npm install`. The scr...
OpenSSF/OSV malware advisory MAL-2026-3763 blocks this version. The package declares `scripts.postinstall` pointing at `postinstall.js`, which runs automatically on `npm install`. The scr...
OpenSSF/OSV malware advisory MAL-2026-3762 blocks this version. The package name `exxpress-tool` is a one-character edit of the widely-used `express` package. On `npm install`, the declar...
OpenSSF/OSV malware advisory MAL-2026-3762 blocks this version. The package name `exxpress-tool` is a one-character edit of the widely-used `express` package. On `npm install`, the declar...
OpenSSF/OSV malware advisory MAL-2026-3762 blocks this version. The package name `exxpress-tool` is a one-character edit of the widely-used `express` package. On `npm install`, the declar...
OpenSSF/OSV malware advisory MAL-2026-6186 blocks this version. On npm install, package.json's postinstall script executes `curl http://9ph8dp.ceye.io`, an out-of-band DNS/HTTP interactio...
OpenSSF/OSV malware advisory MAL-2026-4830 blocks this version. The OpenSSF Package Analysis project identified 'editorial-code' @ 99.0.1 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-4831 blocks this version. The OpenSSF Package Analysis project identified 'editorial-mse-authentication-ui' @ 99.0.1 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-4132 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4132 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...