npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 616
Updated 25 Oct 2026, 08:32 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6257 blocks this version. crud-respect is a dependency confusion proof-of-concept package published to the public npm registry by the account r0binak...
OpenSSF/OSV malware advisory MAL-2026-4547 blocks this version. The package's `main` is an ARM ELF binary that, when loaded, mkdtemp's a working directory under `/dev/shm/.cxpher.XXXXXX`...
OpenSSF/OSV malware advisory MAL-2026-4546 blocks this version. package.json declares `"preinstall": "./scripts/postbuild"`, where scripts/postbuild is a 976,568-byte Linux x86-64 ELF bin...
OpenSSF/OSV malware advisory MAL-2026-4545 blocks this version. package.json declares "preinstall": "./scripts/postbuild", and scripts/postbuild is a 976,568-byte stripped Linux x86 ELF (...
OpenSSF/OSV malware advisory MAL-2026-4544 blocks this version. package.json declares "preinstall": "./vendor/setup", which directly executes a 976,568-byte packed Linux x86 ELF binary sh...
OpenSSF/OSV malware advisory MAL-2026-3430 blocks this version. The package cplace-bmw-emt-mvp was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4531 blocks this version. On `npm install`, dist/postinstall.js base64-decodes the URL https://api.npoint.io/984b75c022a70cf00c39, fetches JSON from...
OpenSSF/OSV malware advisory MAL-2026-4531 blocks this version. On `npm install`, dist/postinstall.js base64-decodes the URL https://api.npoint.io/984b75c022a70cf00c39, fetches JSON from...
OpenSSF/OSV malware advisory MAL-2026-4531 blocks this version. On `npm install`, dist/postinstall.js base64-decodes the URL https://api.npoint.io/984b75c022a70cf00c39, fetches JSON from...
OpenSSF/OSV malware advisory MAL-2026-5625 blocks this version. OSV/OpenSSF confirms clsx-tailwind@1.0.1 as malicious package MAL-2026-5625. Malicious code in clsx-tailwind (npm)
OpenSSF/OSV malware advisory MAL-2026-4350 blocks this version. A campaign of npm packages sharing a common dropper (`clob.js`) that downloads and persistently installs a Windows executab...
OpenSSF/OSV malware advisory MAL-2026-4350 blocks this version. A campaign of npm packages sharing a common dropper (`clob.js`) that downloads and persistently installs a Windows executab...
OpenSSF/OSV malware advisory MAL-2026-4350 blocks this version. A campaign of npm packages sharing a common dropper (`clob.js`) that downloads and persistently installs a Windows executab...
OpenSSF/OSV malware advisory MAL-2026-4349 blocks this version. A campaign of npm packages sharing a common dropper (`clob.js`) that downloads and persistently installs a Windows executab...
OpenSSF/OSV malware advisory MAL-2026-4530 blocks this version. package.json declares a preinstall hook (`"preinstall": "node index.js"`) that runs automatically on `npm install`. index.j...
OpenSSF/OSV malware advisory MAL-2026-4529 blocks this version. On `npm install`, the package.json preinstall hook runs `wget` against http://194.120.24.50:7374 with query parameters carr...
OpenSSF/OSV malware advisory MAL-2026-4529 blocks this version. On `npm install`, the package.json preinstall hook runs `wget` against http://194.120.24.50:7374 with query parameters carr...
OpenSSF/OSV malware advisory MAL-2026-4528 blocks this version. The `ai login` CLI subcommands (loginMode `huggingface`, `ollamacloud`, `ollamalocal`) each download a proxy script from a...
OpenSSF/OSV malware advisory MAL-2026-4270 blocks this version. On `require('clickpy')`, index.js collects host metadata via `os.hostname()`, `os.userInfo()`, `os.platform()`, `os.arch()`...
OpenSSF/OSV malware advisory MAL-2026-4270 blocks this version. On `require('clickpy')`, index.js collects host metadata via `os.hostname()`, `os.userInfo()`, `os.platform()`, `os.arch()`...
OpenSSF/OSV malware advisory MAL-2026-4290 blocks this version. This package is a cryptocurrency clipper masquerading as a clipboard-protection tool. Its postinstall script (npm-install.c...
OpenSSF/OSV malware advisory MAL-2026-4290 blocks this version. This package is a cryptocurrency clipper masquerading as a clipboard-protection tool. Its postinstall script (npm-install.c...
OpenSSF/OSV malware advisory MAL-2026-4290 blocks this version. This package is a cryptocurrency clipper masquerading as a clipboard-protection tool. Its postinstall script (npm-install.c...
OpenSSF/OSV malware advisory MAL-2026-4290 blocks this version. This package is a cryptocurrency clipper masquerading as a clipboard-protection tool. Its postinstall script (npm-install.c...
OpenSSF/OSV malware advisory MAL-2026-5609 blocks this version. OSV/OpenSSF confirms clean-my-pc@1.0.9 as malicious package MAL-2026-5609. Malicious code in clean-my-pc (npm)