npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 601
Updated 24 Oct 2026, 22:46 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6481 blocks this version. Package published at version 99.99.99 under the gx-npm-* namespace, a shape designed to win npm version resolution against...
OpenSSF/OSV malware advisory MAL-2026-6466 blocks this version. gx-npm-feature-flags@99.99.99 is a dependency-confusion squat (max-semver `99.99.99` on a `gx-`-prefixed name to outrank a...
OpenSSF/OSV malware advisory MAL-2026-6480 blocks this version. Package published at version 99.99.99 under a generic name (`gx-npm-lib`) — the canonical dependency-confusion shape used t...
OpenSSF/OSV malware advisory MAL-2026-3310 blocks this version. The package gweb-build-system was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-5612 blocks this version. OSV/OpenSSF confirms gpt-sdk@0.2.4 as malicious package MAL-2026-5612. Malicious code in gpt-sdk (npm)
OpenSSF/OSV malware advisory MAL-2026-5612 blocks this version. OSV/OpenSSF confirms gpt-sdk@0.2.3 as malicious package MAL-2026-5612. Malicious code in gpt-sdk (npm)
OpenSSF/OSV malware advisory MAL-2026-5612 blocks this version. OSV/OpenSSF confirms gpt-sdk@0.2.2 as malicious package MAL-2026-5612. Malicious code in gpt-sdk (npm)
OpenSSF/OSV malware advisory MAL-2026-5612 blocks this version. OSV/OpenSSF confirms gpt-sdk@0.2.1 as malicious package MAL-2026-5612. Malicious code in gpt-sdk (npm)
OpenSSF/OSV malware advisory MAL-2026-5612 blocks this version. OSV/OpenSSF confirms gpt-sdk@0.2.0 as malicious package MAL-2026-5612. Malicious code in gpt-sdk (npm)
OpenSSF/OSV malware advisory MAL-2026-5612 blocks this version. OSV/OpenSSF confirms gpt-sdk@0.1.3 as malicious package MAL-2026-5612. Malicious code in gpt-sdk (npm)
OpenSSF/OSV malware advisory MAL-2026-5612 blocks this version. OSV/OpenSSF confirms gpt-sdk@0.1.2 as malicious package MAL-2026-5612. Malicious code in gpt-sdk (npm)
OpenSSF/OSV malware advisory MAL-2026-5612 blocks this version. OSV/OpenSSF confirms gpt-sdk@0.1.1 as malicious package MAL-2026-5612. Malicious code in gpt-sdk (npm)
OpenSSF/OSV malware advisory MAL-2026-5612 blocks this version. OSV/OpenSSF confirms gpt-sdk@0.1.0 as malicious package MAL-2026-5612. Malicious code in gpt-sdk (npm)
OpenSSF/OSV malware advisory MAL-2026-6375 blocks this version. collect.js bundles a host-reconnaissance and exfiltration payload. It loads child_process, fs, os, http, and https, reads o...
OpenSSF/OSV malware advisory MAL-2026-6375 blocks this version. collect.js bundles a host-reconnaissance and exfiltration payload. It loads child_process, fs, os, http, and https, reads o...
OpenSSF/OSV malware advisory MAL-2026-6537 blocks this version. On `npm install`, the package's preinstall lifecycle script (preinstall.js, declared via scripts.preinstall "node preinstal...
OpenSSF/OSV malware advisory MAL-2026-6537 blocks this version. On `npm install`, the package's preinstall lifecycle script (preinstall.js, declared via scripts.preinstall "node preinstal...
OpenSSF/OSV malware advisory MAL-2026-3764 blocks this version. glob-helper@1.0.2 is a malicious typosquat with no legitimate functionality. Its index.js is a stub; package.json declares...
OpenSSF/OSV malware advisory MAL-2026-3764 blocks this version. glob-helper@1.0.2 is a malicious typosquat with no legitimate functionality. Its index.js is a stub; package.json declares...
OpenSSF/OSV malware advisory MAL-2026-3764 blocks this version. glob-helper@1.0.2 is a malicious typosquat with no legitimate functionality. Its index.js is a stub; package.json declares...
OpenSSF/OSV malware advisory MAL-2026-3764 blocks this version. glob-helper@1.0.2 is a malicious typosquat with no legitimate functionality. Its index.js is a stub; package.json declares...
OpenSSF/OSV malware advisory MAL-2026-3764 blocks this version. glob-helper@1.0.2 is a malicious typosquat with no legitimate functionality. Its index.js is a stub; package.json declares...
OpenSSF/OSV malware advisory MAL-2026-3764 blocks this version. glob-helper@1.0.2 is a malicious typosquat with no legitimate functionality. Its index.js is a stub; package.json declares...
OpenSSF/OSV malware advisory MAL-2026-3764 blocks this version. glob-helper@1.0.2 is a malicious typosquat with no legitimate functionality. Its index.js is a stub; package.json declares...
OpenSSF/OSV malware advisory MAL-2026-4572 blocks this version. Package name typosquats the popular `get-package-type` and reuses its README/exports verbatim, but adds `"postinstall": "no...