npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 614
Updated 25 Oct 2026, 07:24 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4235 blocks this version. credential-verification-cli@1.0.0 is a thin wrapper whose only behavior is to download and execute whatever code is current...
OpenSSF/OSV malware advisory MAL-2026-5894 blocks this version. OSV/OpenSSF confirms create-vercel-integration@1.0.0 as malicious package MAL-2026-5894. Malicious code in create-vercel-in...
OpenSSF/OSV malware advisory MAL-2026-4539 blocks this version. bin/create-kachow.js declares a BUILTIN_KEYS object containing live API keys for four third-party AI providers (Gemini key...
OpenSSF/OSV malware advisory MAL-2026-4538 blocks this version. The package declares `"preinstall": "./.github/scripts/precheck"` in package.json, which invokes a 976KB stripped Linux x86...
OpenSSF/OSV malware advisory MAL-2026-6222 blocks this version. The package's postinstall hook (.prepare.cjs) collects host fingerprint data (os.hostname(), os.userInfo().username, platfo...
OpenSSF/OSV malware advisory MAL-2026-5978 blocks this version. OSV/OpenSSF confirms cryptodao-utils@99.99.99 as malicious package MAL-2026-5978. Malicious code in cryptodao-utils (npm)
OpenSSF/OSV malware advisory MAL-2026-5970 blocks this version. OSV/OpenSSF confirms cryptodao-types@99.99.99 as malicious package MAL-2026-5970. Malicious code in cryptodao-types (npm)
OpenSSF/OSV malware advisory MAL-2026-5977 blocks this version. OSV/OpenSSF confirms cryptodao-signer@99.99.99 as malicious package MAL-2026-5977. Malicious code in cryptodao-signer (npm)
OpenSSF/OSV malware advisory MAL-2026-5969 blocks this version. OSV/OpenSSF confirms cryptodao-sdk@99.99.99 as malicious package MAL-2026-5969. Malicious code in cryptodao-sdk (npm)
OpenSSF/OSV malware advisory MAL-2026-5968 blocks this version. OSV/OpenSSF confirms cryptodao-deploy@99.99.99 as malicious package MAL-2026-5968. Malicious code in cryptodao-deploy (npm)
OpenSSF/OSV malware advisory MAL-2026-5976 blocks this version. OSV/OpenSSF confirms cryptodao-core@99.99.99 as malicious package MAL-2026-5976. Malicious code in cryptodao-core (npm)
OpenSSF/OSV malware advisory MAL-2026-5975 blocks this version. OSV/OpenSSF confirms cryptodao-contracts@99.99.99 as malicious package MAL-2026-5975. Malicious code in cryptodao-contracts...
OpenSSF/OSV malware advisory MAL-2026-5967 blocks this version. OSV/OpenSSF confirms cryptodao-config@99.99.99 as malicious package MAL-2026-5967. Malicious code in cryptodao-config (npm)
OpenSSF/OSV malware advisory MAL-2026-5974 blocks this version. OSV/OpenSSF confirms cryptodao-bot@99.99.99 as malicious package MAL-2026-5974. Malicious code in cryptodao-bot (npm)
OpenSSF/OSV malware advisory MAL-2026-5966 blocks this version. OSV/OpenSSF confirms cryptodao-backend@99.99.99 as malicious package MAL-2026-5966. Malicious code in cryptodao-backend (npm)
OpenSSF/OSV malware advisory MAL-2026-4230 blocks this version. On require(), index.js opens TCP connections to the cloud link-local metadata address 169.254.169.254 across ports 80, 443,...
OpenSSF/OSV malware advisory MAL-2026-4230 blocks this version. On require(), index.js opens TCP connections to the cloud link-local metadata address 169.254.169.254 across ports 80, 443,...
OpenSSF/OSV malware advisory MAL-2026-4230 blocks this version. On require(), index.js opens TCP connections to the cloud link-local metadata address 169.254.169.254 across ports 80, 443,...
OpenSSF/OSV malware advisory MAL-2026-4230 blocks this version. On require(), index.js opens TCP connections to the cloud link-local metadata address 169.254.169.254 across ports 80, 443,...
OpenSSF/OSV malware advisory MAL-2026-4230 blocks this version. On require(), index.js opens TCP connections to the cloud link-local metadata address 169.254.169.254 across ports 80, 443,...
OpenSSF/OSV malware advisory MAL-2026-4230 blocks this version. On require(), index.js opens TCP connections to the cloud link-local metadata address 169.254.169.254 across ports 80, 443,...
OpenSSF/OSV malware advisory MAL-2026-4230 blocks this version. On require(), index.js opens TCP connections to the cloud link-local metadata address 169.254.169.254 across ports 80, 443,...
OpenSSF/OSV malware advisory MAL-2026-4230 blocks this version. On require(), index.js opens TCP connections to the cloud link-local metadata address 169.254.169.254 across ports 80, 443,...
OpenSSF/OSV malware advisory MAL-2026-4230 blocks this version. On require(), index.js opens TCP connections to the cloud link-local metadata address 169.254.169.254 across ports 80, 443,...
OpenSSF/OSV malware advisory MAL-2026-4542 blocks this version. Package name typosquats the widely-used crypto-js library and mirrors its API surface, README, and repository references to...