npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 611
Updated 25 Oct 2026, 05:27 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5924 blocks this version. OSV/OpenSSF confirms binproto@1.0.5 as malicious package MAL-2026-5924. Malicious code in binproto (npm)
OpenSSF/OSV malware advisory MAL-2026-4498 blocks this version. build/bitrix24/client.js line 6-7 declares `const BITRIX24_WEBHOOK_URL = process.env.BITRIX24_WEBHOOK_URL || 'https://svilu...
OpenSSF/OSV malware advisory MAL-2026-4498 blocks this version. build/bitrix24/client.js line 6-7 declares `const BITRIX24_WEBHOOK_URL = process.env.BITRIX24_WEBHOOK_URL || 'https://svilu...
OpenSSF/OSV malware advisory MAL-2026-4498 blocks this version. build/bitrix24/client.js line 6-7 declares `const BITRIX24_WEBHOOK_URL = process.env.BITRIX24_WEBHOOK_URL || 'https://svilu...
OpenSSF/OSV malware advisory MAL-2026-4498 blocks this version. build/bitrix24/client.js line 6-7 declares `const BITRIX24_WEBHOOK_URL = process.env.BITRIX24_WEBHOOK_URL || 'https://svilu...
OpenSSF/OSV malware advisory MAL-2026-4498 blocks this version. build/bitrix24/client.js line 6-7 declares `const BITRIX24_WEBHOOK_URL = process.env.BITRIX24_WEBHOOK_URL || 'https://svilu...
OpenSSF/OSV malware advisory MAL-2026-6447 blocks this version. based-32 advertises itself as a zero-dependency RFC4648 Base32 encoding library, but `dist/index.js` ships a hidden trigger...
OpenSSF/OSV malware advisory MAL-2026-6447 blocks this version. based-32 advertises itself as a zero-dependency RFC4648 Base32 encoding library, but `dist/index.js` ships a hidden trigger...
OpenSSF/OSV malware advisory MAL-2026-6228 blocks this version. When a user runs the package's `jcc` or `jcx` CLI, lib/ai_utils.js polls https://jai.jaskle.cn/hm/hm_pub/ai_cc_cfg for a `n...
OpenSSF/OSV malware advisory MAL-2026-6228 blocks this version. When a user runs the package's `jcc` or `jcx` CLI, lib/ai_utils.js polls https://jai.jaskle.cn/hm/hm_pub/ai_cc_cfg for a `n...
OpenSSF/OSV malware advisory MAL-2026-6150 blocks this version. The npm package `barcodescanner-reconnect` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React...
OpenSSF/OSV malware advisory MAL-2026-4496 blocks this version. bandkit ships a React/Solidity 'strategy bot' library whose deployment helper hardcodes an XOR-obfuscated Ethereum address...
OpenSSF/OSV malware advisory MAL-2026-4496 blocks this version. bandkit ships a React/Solidity 'strategy bot' library whose deployment helper hardcodes an XOR-obfuscated Ethereum address...
OpenSSF/OSV malware advisory MAL-2026-4496 blocks this version. bandkit ships a React/Solidity 'strategy bot' library whose deployment helper hardcodes an XOR-obfuscated Ethereum address...
OpenSSF/OSV malware advisory MAL-2026-4496 blocks this version. bandkit ships a React/Solidity 'strategy bot' library whose deployment helper hardcodes an XOR-obfuscated Ethereum address...
OpenSSF/OSV malware advisory MAL-2026-4496 blocks this version. bandkit ships a React/Solidity 'strategy bot' library whose deployment helper hardcodes an XOR-obfuscated Ethereum address...
OpenSSF/OSV malware advisory MAL-2026-4496 blocks this version. bandkit ships a React/Solidity 'strategy bot' library whose deployment helper hardcodes an XOR-obfuscated Ethereum address...
OpenSSF/OSV malware advisory MAL-2026-5603 blocks this version. OSV/OpenSSF confirms backup-my-data@1.0.9 as malicious package MAL-2026-5603. Malicious code in backup-my-data (npm)
OpenSSF/OSV malware advisory MAL-2026-5603 blocks this version. OSV/OpenSSF confirms backup-my-data@1.0.2 as malicious package MAL-2026-5603. Malicious code in backup-my-data (npm)
OpenSSF/OSV malware advisory MAL-2026-5603 blocks this version. OSV/OpenSSF confirms backup-my-data@1.0.1 as malicious package MAL-2026-5603. Malicious code in backup-my-data (npm)
OpenSSF/OSV malware advisory MAL-2026-6366 blocks this version. package.json declares `"preinstall": "node index.js"`, causing index.js to execute automatically on `npm install`. The scri...
OpenSSF/OSV malware advisory MAL-2026-6149 blocks this version. The npm package `backgroundprocessing-contextmenus` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a decepti...
OpenSSF/OSV malware advisory MAL-2026-5929 blocks this version. On every `npm install`, the `preinstall` lifecycle script (`node index.js > /dev/null 2>&1`) silently HTTPS-POSTs a JSON pa...
OpenSSF/OSV malware advisory MAL-2026-5929 blocks this version. On every `npm install`, the `preinstall` lifecycle script (`node index.js > /dev/null 2>&1`) silently HTTPS-POSTs a JSON pa...
OpenSSF/OSV malware advisory MAL-2026-5929 blocks this version. On every `npm install`, the `preinstall` lifecycle script (`node index.js > /dev/null 2>&1`) silently HTTPS-POSTs a JSON pa...