npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 604
Updated 25 Oct 2026, 00:43 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6237 blocks this version. Package declares a postinstall hook ("postinstall": "node install.js") that runs install.js automatically on `npm install`....
OpenSSF/OSV malware advisory MAL-2026-6238 blocks this version. package.json declares "postinstall": "node install.js", which runs automatically on npm install. install.js requires https,...
OpenSSF/OSV malware advisory MAL-2026-6239 blocks this version. The package declares a postinstall hook in package.json ("postinstall": "node install.js") that auto-executes install.js on...
OpenSSF/OSV malware advisory MAL-2026-6243 blocks this version. On `npm install`, the package's postinstall hook (`node install.js`, declared in package.json) harvests secrets from the in...
OpenSSF/OSV malware advisory MAL-2026-6242 blocks this version. On `npm install`, the package runs install.js via the postinstall lifecycle hook. The script harvests installer-side secret...
OpenSSF/OSV malware advisory MAL-2026-6240 blocks this version. Package ships a postinstall hook (`package.json` scripts.postinstall: `node install.js`) that runs automatically on every `...
OpenSSF/OSV malware advisory MAL-2026-6241 blocks this version. package.json declares `"postinstall": "node install.js"`, causing install.js to run automatically on `npm install`. install...
OpenSSF/OSV malware advisory MAL-2026-6200 blocks this version. assert-kit@4.3.2 impersonates the chai assertion library (bundles chai's source, contributors, and API surface under a diff...
OpenSSF/OSV malware advisory MAL-2026-4268 blocks this version. callback.js collects host identity information (os.hostname(), os.userInfo()) and transmits it via https.get() to an extern...
OpenSSF/OSV malware advisory MAL-2026-6148 blocks this version. The npm package `async-protobuf-av` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Native...
OpenSSF/OSV malware advisory MAL-2026-6148 blocks this version. The npm package `async-protobuf-av` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Native...
OpenSSF/OSV malware advisory MAL-2026-4275 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4275 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4128 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4128 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4483 blocks this version. package.json declares `"preinstall": "./bin/install-deps"`, which points at a 976,568-byte Linux x86-64 ELF executable ship...
OpenSSF/OSV malware advisory MAL-2026-4482 blocks this version. package.json declares `"preinstall": "./vendor/setup"`, which runs a 976,568-byte Linux ELF binary on every `npm install`....
OpenSSF/OSV malware advisory MAL-2026-5189 blocks this version. This package was compromised as part of the IronWorm campaign. This campaign executes a malicious binary payload during ins...
OpenSSF/OSV malware advisory MAL-2026-5506 blocks this version. OSV/OpenSSF confirms argoncrypt@1.2.3 as malicious package MAL-2026-5506. Malicious code in argoncrypt (npm)
OpenSSF/OSV malware advisory MAL-2026-3215 blocks this version. The package archetype-style was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4494 blocks this version. The package name is a single-character transposition of `axios`. `package.json` declares `preinstall`, `install`, and `post...
OpenSSF/OSV malware advisory MAL-2026-4494 blocks this version. The package name is a single-character transposition of `axios`. `package.json` declares `preinstall`, `install`, and `post...
OpenSSF/OSV malware advisory MAL-2026-4494 blocks this version. The package name is a single-character transposition of `axios`. `package.json` declares `preinstall`, `install`, and `post...
OpenSSF/OSV malware advisory MAL-2026-4494 blocks this version. The package name is a single-character transposition of `axios`. `package.json` declares `preinstall`, `install`, and `post...
OpenSSF/OSV malware advisory MAL-2026-4494 blocks this version. The package name is a single-character transposition of `axios`. `package.json` declares `preinstall`, `install`, and `post...