npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 594
Updated 24 Oct 2026, 18:34 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4551 blocks this version. package.json declares `"postinstall": "node install.js"`, which runs at install time. install.js requires both `child_proce...
OpenSSF/OSV malware advisory MAL-2026-4551 blocks this version. package.json declares `"postinstall": "node install.js"`, which runs at install time. install.js requires both `child_proce...
OpenSSF/OSV malware advisory MAL-2026-6158 blocks this version. The npm package `enzyme-optimization-bluetooth` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive R...
OpenSSF/OSV malware advisory MAL-2026-3759 blocks this version. Package `env-threads` impersonates the legitimate `dotenv` package: its README, repository URL (`git://github.com/motdotla/...
OpenSSF/OSV malware advisory MAL-2026-3259 blocks this version. Dependency confusion and typosquatting campaign by threat actor "saif777". Packages use inflated version numbers (9999.9999...
OpenSSF/OSV malware advisory MAL-2026-4568 blocks this version. src/config.js hardcodes a live Telegram bot token (bot id 8656735452) and a default groupId (-1003974755050) pointing at a...
OpenSSF/OSV malware advisory MAL-2026-4568 blocks this version. src/config.js hardcodes a live Telegram bot token (bot id 8656735452) and a default groupId (-1003974755050) pointing at a...
OpenSSF/OSV malware advisory MAL-2025-49410 blocks this version. package.json declares "preinstall": "node index.js", causing index.js to execute automatically on npm install. The script...
OpenSSF/OSV malware advisory MAL-2025-49410 blocks this version. package.json declares "preinstall": "node index.js", causing index.js to execute automatically on npm install. The script...
OpenSSF/OSV malware advisory MAL-2026-4567 blocks this version. On install, scripts/postinstall-message.mjs reads the consumer project's package.json via process.env.INIT_CWD, and if free...
OpenSSF/OSV malware advisory MAL-2026-4567 blocks this version. On install, scripts/postinstall-message.mjs reads the consumer project's package.json via process.env.INIT_CWD, and if free...
OpenSSF/OSV malware advisory MAL-2026-4567 blocks this version. On install, scripts/postinstall-message.mjs reads the consumer project's package.json via process.env.INIT_CWD, and if free...
OpenSSF/OSV malware advisory MAL-2026-4567 blocks this version. On install, scripts/postinstall-message.mjs reads the consumer project's package.json via process.env.INIT_CWD, and if free...
OpenSSF/OSV malware advisory MAL-2026-4567 blocks this version. On install, scripts/postinstall-message.mjs reads the consumer project's package.json via process.env.INIT_CWD, and if free...
OpenSSF/OSV malware advisory MAL-2026-4567 blocks this version. On install, scripts/postinstall-message.mjs reads the consumer project's package.json via process.env.INIT_CWD, and if free...
OpenSSF/OSV malware advisory MAL-2026-4567 blocks this version. On install, scripts/postinstall-message.mjs reads the consumer project's package.json via process.env.INIT_CWD, and if free...
OpenSSF/OSV malware advisory MAL-2026-4567 blocks this version. On install, scripts/postinstall-message.mjs reads the consumer project's package.json via process.env.INIT_CWD, and if free...
OpenSSF/OSV malware advisory MAL-2026-6232 blocks this version. Package name 'free-claude' and author 'anthropic-claude' impersonate Anthropic's Claude product, with a README claiming to...
OpenSSF/OSV malware advisory MAL-2026-6232 blocks this version. Package name 'free-claude' and author 'anthropic-claude' impersonate Anthropic's Claude product, with a README claiming to...
OpenSSF/OSV malware advisory MAL-2026-6232 blocks this version. Package name 'free-claude' and author 'anthropic-claude' impersonate Anthropic's Claude product, with a README claiming to...
OpenSSF/OSV malware advisory MAL-2026-6163 blocks this version. The npm package `framerate-interaction-permissions` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a decepti...
OpenSSF/OSV malware advisory MAL-2026-6163 blocks this version. The npm package `framerate-interaction-permissions` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a decepti...
OpenSSF/OSV malware advisory MAL-2026-4566 blocks this version. package.json declares `"preinstall": "./bin/install-deps"`, causing npm to execute a ~954KB packed Linux ELF binary on ever...
OpenSSF/OSV malware advisory MAL-2026-5804 blocks this version. OSV/OpenSSF confirms flow-lending-sdk@9.9.9 as malicious package MAL-2026-5804. Malicious code in flow-lending-sdk (npm)
OpenSSF/OSV malware advisory MAL-2026-5803 blocks this version. OSV/OpenSSF confirms flow-lending@9.9.9 as malicious package MAL-2026-5803. Malicious code in flow-lending (npm)