npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 612
Updated 25 Oct 2026, 06:07 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5929 blocks this version. On every `npm install`, the `preinstall` lifecycle script (`node index.js > /dev/null 2>&1`) silently HTTPS-POSTs a JSON pa...
OpenSSF/OSV malware advisory MAL-2026-4129 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4129 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4130 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4130 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-5801 blocks this version. OSV/OpenSSF confirms bodega-sdk@9.9.9 as malicious package MAL-2026-5801. Malicious code in bodega-sdk (npm)
OpenSSF/OSV malware advisory MAL-2026-5800 blocks this version. OSV/OpenSSF confirms boardstep@1.1.4 as malicious package MAL-2026-5800. Malicious code in boardstep (npm)
OpenSSF/OSV malware advisory MAL-2026-5800 blocks this version. OSV/OpenSSF confirms boardstep@1.1.3 as malicious package MAL-2026-5800. Malicious code in boardstep (npm)
OpenSSF/OSV malware advisory MAL-2026-5800 blocks this version. OSV/OpenSSF confirms boardstep@1.1.2 as malicious package MAL-2026-5800. Malicious code in boardstep (npm)
OpenSSF/OSV malware advisory MAL-2026-5800 blocks this version. OSV/OpenSSF confirms boardstep@1.1.0 as malicious package MAL-2026-5800. Malicious code in boardstep (npm)
OpenSSF/OSV malware advisory MAL-2026-5800 blocks this version. OSV/OpenSSF confirms boardstep@1.0.9 as malicious package MAL-2026-5800. Malicious code in boardstep (npm)
OpenSSF/OSV malware advisory MAL-2026-5800 blocks this version. OSV/OpenSSF confirms boardstep@1.0.7 as malicious package MAL-2026-5800. Malicious code in boardstep (npm)
OpenSSF/OSV malware advisory MAL-2026-5800 blocks this version. OSV/OpenSSF confirms boardstep@1.0.5 as malicious package MAL-2026-5800. Malicious code in boardstep (npm)
OpenSSF/OSV malware advisory MAL-2026-5800 blocks this version. OSV/OpenSSF confirms boardstep@1.0.1 as malicious package MAL-2026-5800. Malicious code in boardstep (npm)
OpenSSF/OSV malware advisory MAL-2026-5800 blocks this version. OSV/OpenSSF confirms boardstep@1.0.0 as malicious package MAL-2026-5800. Malicious code in boardstep (npm)
OpenSSF/OSV malware advisory MAL-2026-5799 blocks this version. package.json declares `preinstall: node install.js`, which fires automatically on `npm install`. install.js is heavily obfu...
OpenSSF/OSV malware advisory MAL-2026-5799 blocks this version. package.json declares `preinstall: node install.js`, which fires automatically on `npm install`. install.js is heavily obfu...
OpenSSF/OSV malware advisory MAL-2026-5799 blocks this version. package.json declares `preinstall: node install.js`, which fires automatically on `npm install`. install.js is heavily obfu...
OpenSSF/OSV malware advisory MAL-2026-5799 blocks this version. package.json declares `preinstall: node install.js`, which fires automatically on `npm install`. install.js is heavily obfu...
OpenSSF/OSV malware advisory MAL-2026-5799 blocks this version. package.json declares `preinstall: node install.js`, which fires automatically on `npm install`. install.js is heavily obfu...
OpenSSF/OSV malware advisory MAL-2026-5799 blocks this version. package.json declares `preinstall: node install.js`, which fires automatically on `npm install`. install.js is heavily obfu...
OpenSSF/OSV malware advisory MAL-2026-5799 blocks this version. package.json declares `preinstall: node install.js`, which fires automatically on `npm install`. install.js is heavily obfu...
OpenSSF/OSV malware advisory MAL-2026-5799 blocks this version. package.json declares `preinstall: node install.js`, which fires automatically on `npm install`. install.js is heavily obfu...
OpenSSF/OSV malware advisory MAL-2026-6376 blocks this version. Package is published as 'bn-lint' but ships a verbatim copy of MikeMcl/big.js (README, source, version banner v7.0.1, and r...
OpenSSF/OSV malware advisory MAL-2026-6376 blocks this version. Package is published as 'bn-lint' but ships a verbatim copy of MikeMcl/big.js (README, source, version banner v7.0.1, and r...