npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 600
Updated 24 Oct 2026, 22:03 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5464 blocks this version. db-xorma advertises itself as a reactive in-memory database library. When a consumer creates any Model instance (the docume...
OpenSSF/OSV malware advisory MAL-2026-5464 blocks this version. db-xorma advertises itself as a reactive in-memory database library. When a consumer creates any Model instance (the docume...
OpenSSF/OSV malware advisory MAL-2026-6301 blocks this version. Package is advertised as a React date-formatting utility, but its postinstall.js performs targeted credential harvesting on...
OpenSSF/OSV malware advisory MAL-2026-6301 blocks this version. Package is advertised as a React date-formatting utility, but its postinstall.js performs targeted credential harvesting on...
OpenSSF/OSV malware advisory MAL-2026-6301 blocks this version. Package is advertised as a React date-formatting utility, but its postinstall.js performs targeted credential harvesting on...
OpenSSF/OSV malware advisory MAL-2026-6301 blocks this version. Package is advertised as a React date-formatting utility, but its postinstall.js performs targeted credential harvesting on...
OpenSSF/OSV malware advisory MAL-2026-6301 blocks this version. Package is advertised as a React date-formatting utility, but its postinstall.js performs targeted credential harvesting on...
OpenSSF/OSV malware advisory MAL-2026-6301 blocks this version. Package is advertised as a React date-formatting utility, but its postinstall.js performs targeted credential harvesting on...
OpenSSF/OSV malware advisory MAL-2026-6301 blocks this version. Package is advertised as a React date-formatting utility, but its postinstall.js performs targeted credential harvesting on...
OpenSSF/OSV malware advisory MAL-2026-6154 blocks this version. The npm package `datapersistence-steppers-ai` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive Rea...
OpenSSF/OSV malware advisory MAL-2026-6153 blocks this version. The npm package `datapersistence-profiling` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React...
OpenSSF/OSV malware advisory MAL-2026-6153 blocks this version. The npm package `datapersistence-profiling` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React...
OpenSSF/OSV malware advisory MAL-2026-6091 blocks this version. Package impersonates the DataCamp brand while shipping near-empty stub exports (index.js `init`/`helper` return trivial con...
OpenSSF/OSV malware advisory MAL-2026-6090 blocks this version. The package declares a postinstall lifecycle hook ("postinstall": "node run.js" in package.json) that automatically execute...
OpenSSF/OSV malware advisory MAL-2026-6156 blocks this version. The npm package `documents-widgets` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Native...
OpenSSF/OSV malware advisory MAL-2026-6156 blocks this version. The npm package `documents-widgets` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Native...
OpenSSF/OSV malware advisory MAL-2026-3758 blocks this version. Package name `dotenvv-tool` impersonates the popular `dotenv` package; index.js is an admitted dummy stub ("The real payloa...
OpenSSF/OSV malware advisory MAL-2026-3758 blocks this version. Package name `dotenvv-tool` impersonates the popular `dotenv` package; index.js is an admitted dummy stub ("The real payloa...
OpenSSF/OSV malware advisory MAL-2026-3758 blocks this version. Package name `dotenvv-tool` impersonates the popular `dotenv` package; index.js is an admitted dummy stub ("The real payloa...
OpenSSF/OSV malware advisory MAL-2026-3758 blocks this version. Package name `dotenvv-tool` impersonates the popular `dotenv` package; index.js is an admitted dummy stub ("The real payloa...
OpenSSF/OSV malware advisory MAL-2026-3758 blocks this version. Package name `dotenvv-tool` impersonates the popular `dotenv` package; index.js is an admitted dummy stub ("The real payloa...
OpenSSF/OSV malware advisory MAL-2026-4549 blocks this version. On every import, dist/index.js base64-decodes a hardcoded AES-256-CBC ciphertext, derives a key from environment variable V...
OpenSSF/OSV malware advisory MAL-2026-4549 blocks this version. On every import, dist/index.js base64-decodes a hardcoded AES-256-CBC ciphertext, derives a key from environment variable V...
OpenSSF/OSV malware advisory MAL-2026-4549 blocks this version. On every import, dist/index.js base64-decodes a hardcoded AES-256-CBC ciphertext, derives a key from environment variable V...
OpenSSF/OSV malware advisory MAL-2026-5826 blocks this version. OSV/OpenSSF confirms dms-backend@1.0.0 as malicious package MAL-2026-5826. Malicious code in dms-backend (npm)