npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 617
Updated 25 Oct 2026, 09:10 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5609 blocks this version. OSV/OpenSSF confirms clean-my-pc@1.0.5 as malicious package MAL-2026-5609. Malicious code in clean-my-pc (npm)
OpenSSF/OSV malware advisory MAL-2026-5609 blocks this version. OSV/OpenSSF confirms clean-my-pc@1.0.4 as malicious package MAL-2026-5609. Malicious code in clean-my-pc (npm)
OpenSSF/OSV malware advisory MAL-2026-5609 blocks this version. OSV/OpenSSF confirms clean-my-pc@1.0.3 as malicious package MAL-2026-5609. Malicious code in clean-my-pc (npm)
OpenSSF/OSV malware advisory MAL-2026-5609 blocks this version. OSV/OpenSSF confirms clean-my-pc@1.0.2 as malicious package MAL-2026-5609. Malicious code in clean-my-pc (npm)
OpenSSF/OSV malware advisory MAL-2026-5609 blocks this version. OSV/OpenSSF confirms clean-my-pc@1.0.1 as malicious package MAL-2026-5609. Malicious code in clean-my-pc (npm)
OpenSSF/OSV malware advisory MAL-2026-3822 blocks this version. The package clementine-sdk was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-5893 blocks this version. OSV/OpenSSF confirms claude-jar@0.2.0 as malicious package MAL-2026-5893. Malicious code in claude-jar (npm)
OpenSSF/OSV malware advisory MAL-2026-3811 blocks this version. The package claude-code-base-action was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3811 blocks this version. The package claude-code-base-action was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4524 blocks this version. On `npm install`, the package's postinstall hook runs scripts/install-dependencies.sh, which performs `git clone --depth 1...
OpenSSF/OSV malware advisory MAL-2026-4523 blocks this version. On `npm install`, postinstall.js executes `whoami` and `id`, reads `os.hostname()`, `os.platform()`, `process.cwd()`, and t...
OpenSSF/OSV malware advisory MAL-2026-4525 blocks this version. Package name impersonates an internal Anthropic 'claude-*' namespace and the description field self-identifies as 'Alex Bir...
OpenSSF/OSV malware advisory MAL-2026-4522 blocks this version. On install, postinstall.js writes configuration into ~/.claude/, ~/.gemini/, ~/.codex/, and ~/.kiro/ that hard-wires AI too...
OpenSSF/OSV malware advisory MAL-2026-4522 blocks this version. On install, postinstall.js writes configuration into ~/.claude/, ~/.gemini/, ~/.codex/, and ~/.kiro/ that hard-wires AI too...
OpenSSF/OSV malware advisory MAL-2026-4522 blocks this version. On install, postinstall.js writes configuration into ~/.claude/, ~/.gemini/, ~/.codex/, and ~/.kiro/ that hard-wires AI too...
OpenSSF/OSV malware advisory MAL-2026-4520 blocks this version. The package advertises itself as a clsx/twMerge-style class-name merging utility, but the exported applyGlobalStyles({palet...
OpenSSF/OSV malware advisory MAL-2026-4520 blocks this version. The package advertises itself as a clsx/twMerge-style class-name merging utility, but the exported applyGlobalStyles({palet...
OpenSSF/OSV malware advisory MAL-2026-4520 blocks this version. The package advertises itself as a clsx/twMerge-style class-name merging utility, but the exported applyGlobalStyles({palet...
OpenSSF/OSV malware advisory MAL-2026-4520 blocks this version. The package advertises itself as a clsx/twMerge-style class-name merging utility, but the exported applyGlobalStyles({palet...
OpenSSF/OSV malware advisory MAL-2026-5608 blocks this version. OSV/OpenSSF confirms claimora@1.0.4 as malicious package MAL-2026-5608. Malicious code in claimora (npm)
OpenSSF/OSV malware advisory MAL-2026-3752 blocks this version. The package ships cdp_inject.js, which combines child_process, fs, http/https, and base64 encoding to gather system informa...
OpenSSF/OSV malware advisory MAL-2026-3752 blocks this version. The package ships cdp_inject.js, which combines child_process, fs, http/https, and base64 encoding to gather system informa...
OpenSSF/OSV malware advisory MAL-2026-4255 blocks this version. The package declares a `preinstall` hook (`node index.js`) in package.json that fires automatically on `npm install`. The s...
OpenSSF/OSV malware advisory MAL-2026-4255 blocks this version. The package declares a `preinstall` hook (`node index.js`) in package.json that fires automatically on `npm install`. The s...
OpenSSF/OSV malware advisory MAL-2026-4255 blocks this version. The package declares a `preinstall` hook (`node index.js`) in package.json that fires automatically on `npm install`. The s...