npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 609
Updated 25 Oct 2026, 04:09 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6086 blocks this version. collect.js performs system reconnaissance and exfiltration to a hardcoded attacker-controlled host. The script imports chil...
OpenSSF/OSV malware advisory MAL-2026-6086 blocks this version. collect.js performs system reconnaissance and exfiltration to a hardcoded attacker-controlled host. The script imports chil...
OpenSSF/OSV malware advisory MAL-2026-5937 blocks this version. OSV/OpenSSF confirms abuden21@1.7.7 as malicious package MAL-2026-5937. Malicious code in abuden21 (npm)
OpenSSF/OSV malware advisory MAL-2026-6463 blocks this version. package.json declares preinstall and postinstall hooks that invoke curl against a hardcoded bare-IP HTTP endpoint (http://6...
OpenSSF/OSV malware advisory MAL-2026-3149 blocks this version. Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Ap...
OpenSSF/OSV malware advisory MAL-2026-6444 blocks this version. The package advertises itself as a zero-dependency pure-JS markdown sync tool (~150 lines) but ships an undocumented 2.9MB...
OpenSSF/OSV malware advisory MAL-2026-3605 blocks this version. This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor.
OpenSSF/OSV malware advisory MAL-2026-3605 blocks this version. This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor.
OpenSSF/OSV malware advisory MAL-2026-4480 blocks this version. package.json declares `"preinstall": "./scripts/postbuild"`, where `scripts/postbuild` is a 976KB UPX-packed Linux x86-64 E...
OpenSSF/OSV malware advisory MAL-2026-3613 blocks this version. The OpenSSF Package Analysis project identified 'aoflcorp' @ 0.0.1 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-3614 blocks this version. The OpenSSF Package Analysis project identified 'aoflmkt' @ 1.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-6147 blocks this version. The npm package `analytics-readability-gestures` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive...
OpenSSF/OSV malware advisory MAL-2026-4479 blocks this version. This package impersonates Anthropic's internal namespace and self-describes as 'Full RCE PoC - Alex Birsan Style'. Its pack...
OpenSSF/OSV malware advisory MAL-2026-4127 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4127 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-3804 blocks this version. The package bui-react-10components was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6151 blocks this version. The npm package `buildautomation-touch` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Nat...
OpenSSF/OSV malware advisory MAL-2026-6151 blocks this version. The npm package `buildautomation-touch` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Nat...
OpenSSF/OSV malware advisory MAL-2026-6196 blocks this version. Package name suggests build telemetry tooling, but the tarball ships beacon scripts (beacon18.js, beacon_linux.js) wired to...
OpenSSF/OSV malware advisory MAL-2026-4276 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4276 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4232 blocks this version. The package contains no functionality of its own. Its `postinstall` lifecycle hook runs `npx env-security-scanner@latest au...
OpenSSF/OSV malware advisory MAL-2026-6349 blocks this version. package.json declares `preinstall: node index.js`, causing index.js to run automatically on `npm install`. The script colle...
OpenSSF/OSV malware advisory MAL-2026-2920 blocks this version. On require/import, index.js decodes a base64 string literal to https://www.jsonkeeper.com/b/CWOV9, fetches that anonymous J...
OpenSSF/OSV malware advisory MAL-2026-2920 blocks this version. On require/import, index.js decodes a base64 string literal to https://www.jsonkeeper.com/b/CWOV9, fetches that anonymous J...