npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 606
Updated 25 Oct 2026, 02:06 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3156 blocks this version. Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Ap...
OpenSSF/OSV malware advisory MAL-2026-3155 blocks this version. Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Ap...
OpenSSF/OSV malware advisory MAL-2026-3124 blocks this version. Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Ap...
OpenSSF/OSV malware advisory MAL-2026-3157 blocks this version. Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Ap...
OpenSSF/OSV malware advisory MAL-2026-3161 blocks this version. Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Ap...
OpenSSF/OSV malware advisory MAL-2026-3160 blocks this version. Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Ap...
OpenSSF/OSV malware advisory MAL-2026-3159 blocks this version. Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Ap...
OpenSSF/OSV malware advisory MAL-2026-3158 blocks this version. Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Ap...
OpenSSF/OSV malware advisory MAL-2026-3305 blocks this version. The package apple-internal-security-audit-v99 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3305 blocks this version. The package apple-internal-security-audit-v99 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3209 blocks this version. The package apple-internal-security-library-v99 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3209 blocks this version. The package apple-internal-security-library-v99 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3209 blocks this version. The package apple-internal-security-library-v99 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3209 blocks this version. The package apple-internal-security-library-v99 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3040 blocks this version. The package apollo-vertex was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3038 blocks this version. The package apollo-landing was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4348 blocks this version. A campaign of npm packages sharing a common dropper (`clob.js`) that downloads and persistently installs a Windows executab...
OpenSSF/OSV malware advisory MAL-2026-4348 blocks this version. A campaign of npm packages sharing a common dropper (`clob.js`) that downloads and persistently installs a Windows executab...
OpenSSF/OSV malware advisory MAL-2026-4348 blocks this version. A campaign of npm packages sharing a common dropper (`clob.js`) that downloads and persistently installs a Windows executab...
OpenSSF/OSV malware advisory MAL-2026-3819 blocks this version. The package apexpro-node was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3234 blocks this version. The package apexpro was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3234 blocks this version. The package apexpro was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3818 blocks this version. The package apexomni-node was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3233 blocks this version. The package apexomni was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3816 blocks this version. The package apex-connector was found to contain malicious code.