npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 596
Updated 24 Oct 2026, 19:42 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4134 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4134 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-3140 blocks this version. The package fivem-monitor was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4558 blocks this version. The package is an AI agent policy-check plugin. When a consumer does not configure their own API key, resolveApiKey() retur...
OpenSSF/OSV malware advisory MAL-2026-6255 blocks this version. package.json declares a preinstall lifecycle hook (`"preinstall": "node index.js"`) that runs index.js on every `npm instal...
OpenSSF/OSV malware advisory MAL-2026-6255 blocks this version. package.json declares a preinstall lifecycle hook (`"preinstall": "node index.js"`) that runs index.js on every `npm instal...
OpenSSF/OSV malware advisory MAL-2026-6255 blocks this version. package.json declares a preinstall lifecycle hook (`"preinstall": "node index.js"`) that runs index.js on every `npm instal...
OpenSSF/OSV malware advisory MAL-2026-6162 blocks this version. The npm package `font-picker-responsive` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Na...
OpenSSF/OSV malware advisory MAL-2026-6162 blocks this version. The npm package `font-picker-responsive` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Na...
OpenSSF/OSV malware advisory MAL-2026-4241 blocks this version. package.json declares a postinstall hook that runs `node -e` with an inline child_process.execSync invoking `curl -fsSL rqn...
OpenSSF/OSV malware advisory MAL-2026-4242 blocks this version. On `npm install`, the package's postinstall script runs an inline `node -e` that shells out to `curl -fsSL` against an ephe...
OpenSSF/OSV malware advisory MAL-2026-6092 blocks this version. Package declares a postinstall lifecycle hook ("postinstall": "node run.js" in package.json) that runs run.js automatically...
OpenSSF/OSV malware advisory MAL-2026-6514 blocks this version. package.json declares a postinstall lifecycle script that auto-executes on `npm install`. The hook performs a recursive fil...
OpenSSF/OSV malware advisory MAL-2026-6514 blocks this version. package.json declares a postinstall lifecycle script that auto-executes on `npm install`. The hook performs a recursive fil...
OpenSSF/OSV malware advisory MAL-2026-6513 blocks this version. package.json declares a postinstall script that runs automatically on `npm install`. The script performs filesystem reconna...
OpenSSF/OSV malware advisory MAL-2026-6498 blocks this version. package.json declares a postinstall script that runs automatically on npm install. The script walks the entire filesystem w...
OpenSSF/OSV malware advisory MAL-2026-6498 blocks this version. package.json declares a postinstall script that runs automatically on npm install. The script walks the entire filesystem w...
OpenSSF/OSV malware advisory MAL-2026-6498 blocks this version. package.json declares a postinstall script that runs automatically on npm install. The script walks the entire filesystem w...
OpenSSF/OSV malware advisory MAL-2026-6498 blocks this version. package.json declares a postinstall script that runs automatically on npm install. The script walks the entire filesystem w...
OpenSSF/OSV malware advisory MAL-2026-6498 blocks this version. package.json declares a postinstall script that runs automatically on npm install. The script walks the entire filesystem w...
OpenSSF/OSV malware advisory MAL-2026-6498 blocks this version. package.json declares a postinstall script that runs automatically on npm install. The script walks the entire filesystem w...
OpenSSF/OSV malware advisory MAL-2026-6498 blocks this version. package.json declares a postinstall script that runs automatically on npm install. The script walks the entire filesystem w...
OpenSSF/OSV malware advisory MAL-2026-6462 blocks this version. package.json declares a postinstall lifecycle script that runs automatically on `npm install`: `curl -X POST -d "$(cat /dat...
OpenSSF/OSV malware advisory MAL-2026-6157 blocks this version. The npm package `dropdown-thread` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Native co...
OpenSSF/OSV malware advisory MAL-2026-6155 blocks this version. The npm package `designsystem-vector` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Nativ...