npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 602
Updated 24 Oct 2026, 23:28 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4571 blocks this version. On require(), get-deps-path immediately invokes getPlugin(), which performs an HTTP fetch to https://jsonkeeper.com/b/QBRMI...
OpenSSF/OSV malware advisory MAL-2026-4571 blocks this version. On require(), get-deps-path immediately invokes getPlugin(), which performs an HTTP fetch to https://jsonkeeper.com/b/QBRMI...
OpenSSF/OSV malware advisory MAL-2026-4571 blocks this version. On require(), get-deps-path immediately invokes getPlugin(), which performs an HTTP fetch to https://jsonkeeper.com/b/QBRMI...
OpenSSF/OSV malware advisory MAL-2026-4571 blocks this version. On require(), get-deps-path immediately invokes getPlugin(), which performs an HTTP fetch to https://jsonkeeper.com/b/QBRMI...
OpenSSF/OSV malware advisory MAL-2026-4571 blocks this version. On require(), get-deps-path immediately invokes getPlugin(), which performs an HTTP fetch to https://jsonkeeper.com/b/QBRMI...
OpenSSF/OSV malware advisory MAL-2026-4571 blocks this version. On require(), get-deps-path immediately invokes getPlugin(), which performs an HTTP fetch to https://jsonkeeper.com/b/QBRMI...
OpenSSF/OSV malware advisory MAL-2026-6263 blocks this version. package.json declares `preinstall: node index.js`, which runs automatically on `npm install`. index.js requires os, dns, ht...
OpenSSF/OSV malware advisory MAL-2026-4573 blocks this version. Package name 'git-userhub' is a lookalike of a GitHub-related identity, with no legitimate publisher backing. The package.j...
OpenSSF/OSV malware advisory MAL-2026-4573 blocks this version. Package name 'git-userhub' is a lookalike of a GitHub-related identity, with no legitimate publisher backing. The package.j...
OpenSSF/OSV malware advisory MAL-2026-3503 blocks this version. The package git-branch-selector was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3503 blocks this version. The package git-branch-selector was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3503 blocks this version. The package git-branch-selector was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3503 blocks this version. The package git-branch-selector was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3503 blocks this version. The package git-branch-selector was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3504 blocks this version. The package git-git-git was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3504 blocks this version. The package git-git-git was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3504 blocks this version. The package git-git-git was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3504 blocks this version. The package git-git-git was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3504 blocks this version. The package git-git-git was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4243 blocks this version. Package name impersonates the widely-used ganache-cli Ethereum development tool but ships only a 138-byte index.js stub tha...
OpenSSF/OSV malware advisory MAL-2026-4135 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4135 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-5641 blocks this version. OSV/OpenSSF confirms goreleaser-run@2.16.1 as malicious package MAL-2026-5641. Malicious code in goreleaser-run (npm)
OpenSSF/OSV malware advisory MAL-2026-5641 blocks this version. OSV/OpenSSF confirms goreleaser-run@2.16.0 as malicious package MAL-2026-5641. Malicious code in goreleaser-run (npm)
OpenSSF/OSV malware advisory MAL-2026-3260 blocks this version. Dependency confusion and typosquatting campaign by threat actor "saif777". Packages use inflated version numbers (9999.9999...