npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 595
Updated 24 Oct 2026, 19:01 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5806 blocks this version. OSV/OpenSSF confirms flowdefi@9.9.9 as malicious package MAL-2026-5806. Malicious code in flowdefi (npm)
OpenSSF/OSV malware advisory MAL-2026-5805 blocks this version. OSV/OpenSSF confirms flowcardano@9.9.9 as malicious package MAL-2026-5805. Malicious code in flowcardano (npm)
OpenSSF/OSV malware advisory MAL-2026-6161 blocks this version. The npm package `flexbox-oauth-machinelearning` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive R...
OpenSSF/OSV malware advisory MAL-2026-6161 blocks this version. The npm package `flexbox-oauth-machinelearning` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive R...
OpenSSF/OSV malware advisory MAL-2026-3253 blocks this version. The package feature-flag-service was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3253 blocks this version. The package feature-flag-service was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6160 blocks this version. The npm package `firebase-readability` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Nati...
OpenSSF/OSV malware advisory MAL-2026-6160 blocks this version. The npm package `firebase-readability` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Nati...
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...
OpenSSF/OSV malware advisory MAL-2026-4563 blocks this version. The package ships a single heavily-obfuscated cli.obf.js (RC4 string-array via javascript-obfuscator, per the prepublishOnl...
OpenSSF/OSV malware advisory MAL-2026-4563 blocks this version. The package ships a single heavily-obfuscated cli.obf.js (RC4 string-array via javascript-obfuscator, per the prepublishOnl...
OpenSSF/OSV malware advisory MAL-2026-4563 blocks this version. The package ships a single heavily-obfuscated cli.obf.js (RC4 string-array via javascript-obfuscator, per the prepublishOnl...
OpenSSF/OSV malware advisory MAL-2026-4133 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4133 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...