npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 603
Updated 25 Oct 2026, 00:07 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3309 blocks this version. Malicious npm package published by the `microsop` threat actor as part of a dependency-confusion campaign that impersonates...
OpenSSF/OSV malware advisory MAL-2026-4574 blocks this version. package.json declares an `install` lifecycle script that runs `bin/gm-kilo.js install`. At install time, the script execute...
OpenSSF/OSV malware advisory MAL-2026-4487 blocks this version. The package's postinstall script executes shell reconnaissance (`id || ver && whoami && hostname`), fetches the installer's...
OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...
OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...
OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...
OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...
OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...
OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...
OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...
OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...
OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...
OpenSSF/OSV malware advisory MAL-2026-4491 blocks this version. On require('authcascade'), the package's main entry pino.js loads lib/writer.js which (a) builds a data object containing t...
OpenSSF/OSV malware advisory MAL-2026-4491 blocks this version. On require('authcascade'), the package's main entry pino.js loads lib/writer.js which (a) builds a data object containing t...
OpenSSF/OSV malware advisory MAL-2024-1783 blocks this version. OSV/OpenSSF confirms auth0.net@7.22.1 as malicious package MAL-2024-1783. Malicious code in auth0.net (npm)
OpenSSF/OSV malware advisory MAL-2024-1783 blocks this version. OSV/OpenSSF confirms auth0.net@39.1.0 as malicious package MAL-2024-1783. Malicious code in auth0.net (npm)
OpenSSF/OSV malware advisory MAL-2026-4490 blocks this version. Package name impersonates the Auth0 ecosystem. Its postinstall hook (`node index.js`) runs unconditionally on `npm install`...
OpenSSF/OSV malware advisory MAL-2026-4490 blocks this version. Package name impersonates the Auth0 ecosystem. Its postinstall hook (`node index.js`) runs unconditionally on `npm install`...
OpenSSF/OSV malware advisory MAL-2026-4489 blocks this version. Package name 'auth0-templates-scripts' impersonates the Auth0 (Okta) brand without affiliation. The author field is the pla...
OpenSSF/OSV malware advisory MAL-2026-4489 blocks this version. Package name 'auth0-templates-scripts' impersonates the Auth0 (Okta) brand without affiliation. The author field is the pla...
OpenSSF/OSV malware advisory MAL-2026-3648 blocks this version. Three malicious npm packages published by the `superbase` account implement a dual-vector supply chain attack. Each package...
OpenSSF/OSV malware advisory MAL-2026-4488 blocks this version. On require('auth-basic-vault'), lib/writer.js attempts to require('authcascade') at module top level and, on failure, shell...
OpenSSF/OSV malware advisory MAL-2026-4486 blocks this version. package.json declares `preinstall:./.github/scripts/precheck`, which executes a 976 KB stripped, UPX-packed Linux x86_64 EL...
OpenSSF/OSV malware advisory MAL-2026-5891 blocks this version. Package impersonates an internal Atlassian Forge dependency (unscoped name `atlassian-forge-skills`, description 'Internal...
OpenSSF/OSV malware advisory MAL-2026-6237 blocks this version. Package declares a postinstall hook ("postinstall": "node install.js") that runs install.js automatically on `npm install`....