npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 610
Updated 25 Oct 2026, 04:45 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-2920 blocks this version. On require/import, index.js decodes a base64 string literal to https://www.jsonkeeper.com/b/CWOV9, fetches that anonymous J...
OpenSSF/OSV malware advisory MAL-2026-6348 blocks this version. The package declares a postinstall hook (`"postinstall": "node run.js"`) that executes run.js automatically on `npm install...
OpenSSF/OSV malware advisory MAL-2026-3423 blocks this version. The package byvendors was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3423 blocks this version. The package byvendors was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3846 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-3846 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-3307 blocks this version. The package browserslist-db was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4500 blocks this version. bricks-builder-mcp is a Model Context Protocol server exposing WordPress/Bricks Builder editing tools (page JSON edits, med...
OpenSSF/OSV malware advisory MAL-2026-4500 blocks this version. bricks-builder-mcp is a Model Context Protocol server exposing WordPress/Bricks Builder editing tools (page JSON edits, med...
OpenSSF/OSV malware advisory MAL-2026-4500 blocks this version. bricks-builder-mcp is a Model Context Protocol server exposing WordPress/Bricks Builder editing tools (page JSON edits, med...
OpenSSF/OSV malware advisory MAL-2026-4500 blocks this version. bricks-builder-mcp is a Model Context Protocol server exposing WordPress/Bricks Builder editing tools (page JSON edits, med...
OpenSSF/OSV malware advisory MAL-2026-5182 blocks this version. The OpenSSF Package Analysis project identified 'brave-search-mcp-server' @ 1.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-3306 blocks this version. The package bpmn-studio was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6249 blocks this version. On `npm install`, the package's `preinstall` lifecycle hook runs `curl` against `http://d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.o...
OpenSSF/OSV malware advisory MAL-2026-5716 blocks this version. OSV/OpenSSF confirms beamz@1.0.8 as malicious package MAL-2026-5716. Malicious code in beamz (npm)
OpenSSF/OSV malware advisory MAL-2026-5716 blocks this version. OSV/OpenSSF confirms beamz@1.0.5 as malicious package MAL-2026-5716. Malicious code in beamz (npm)
OpenSSF/OSV malware advisory MAL-2026-5716 blocks this version. OSV/OpenSSF confirms beamz@1.0.14 as malicious package MAL-2026-5716. Malicious code in beamz (npm)
OpenSSF/OSV malware advisory MAL-2026-5716 blocks this version. OSV/OpenSSF confirms beamz@1.0.13 as malicious package MAL-2026-5716. Malicious code in beamz (npm)
OpenSSF/OSV malware advisory MAL-2026-5716 blocks this version. OSV/OpenSSF confirms beamz@1.0.12 as malicious package MAL-2026-5716. Malicious code in beamz (npm)
OpenSSF/OSV malware advisory MAL-2026-5716 blocks this version. OSV/OpenSSF confirms beamz@1.0.11 as malicious package MAL-2026-5716. Malicious code in beamz (npm)
OpenSSF/OSV malware advisory MAL-2026-4497 blocks this version. package.json declares `bin.claude = bin/claude-win.cjs` and `bin.claude-linux = bin/claude` under a non-Anthropic publisher...
OpenSSF/OSV malware advisory MAL-2026-4497 blocks this version. package.json declares `bin.claude = bin/claude-win.cjs` and `bin.claude-linux = bin/claude` under a non-Anthropic publisher...
OpenSSF/OSV malware advisory MAL-2026-5924 blocks this version. OSV/OpenSSF confirms binproto@1.0.7 as malicious package MAL-2026-5924. Malicious code in binproto (npm)
OpenSSF/OSV malware advisory MAL-2026-5924 blocks this version. OSV/OpenSSF confirms binproto@1.0.5 as malicious package MAL-2026-5924. Malicious code in binproto (npm)
OpenSSF/OSV malware advisory MAL-2026-4498 blocks this version. build/bitrix24/client.js line 6-7 declares `const BITRIX24_WEBHOOK_URL = process.env.BITRIX24_WEBHOOK_URL || 'https://svilu...