npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 607
Updated 25 Oct 2026, 02:48 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3817 blocks this version. The package apex-trading was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3304 blocks this version. The package apcyber-test-package was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3304 blocks this version. The package apcyber-test-package was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3616 blocks this version. The OpenSSF Package Analysis project identified 'afk-react-intl' @ 99.99.99 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-4477 blocks this version. package.json declares a preinstall lifecycle script that runs `wget` against https://webhook.site/64063d25-fcd3-44e5-a454-3...
OpenSSF/OSV malware advisory MAL-2026-3302 blocks this version. The package ally-starter-api was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3302 blocks this version. The package ally-starter-api was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3301 blocks this version. The package ally-json-threat-protect was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3301 blocks this version. The package ally-json-threat-protect was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3300 blocks this version. The package ally-forms was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3300 blocks this version. The package ally-forms was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3299 blocks this version. The package ally-eagw-identity was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3299 blocks this version. The package ally-eagw-identity was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3297 blocks this version. The package ally-call-wait-time was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3297 blocks this version. The package ally-call-wait-time was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3298 blocks this version. The package ally-ccapi was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3298 blocks this version. The package ally-ccapi was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3296 blocks this version. The package ally-badges was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3296 blocks this version. The package ally-badges was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3295 blocks this version. The package ally-antivirus was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3295 blocks this version. The package ally-antivirus was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3294 blocks this version. The package ally-allowlist was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3294 blocks this version. The package ally-allowlist was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3303 blocks this version. The package ally-whitelist was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3303 blocks this version. The package ally-whitelist was found to contain malicious code.