npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 619
Updated 25 Oct 2026, 10:33 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6300 blocks this version. chalk-ultra is published under a name that mimics the widely-used `chalk` package, but its `main` is a verbatim copy of nod...
OpenSSF/OSV malware advisory MAL-2026-6300 blocks this version. chalk-ultra is published under a name that mimics the widely-used `chalk` package, but its `main` is a verbatim copy of nod...
OpenSSF/OSV malware advisory MAL-2026-6300 blocks this version. chalk-ultra is published under a name that mimics the widely-used `chalk` package, but its `main` is a verbatim copy of nod...
OpenSSF/OSV malware advisory MAL-2026-4517 blocks this version. Package name `chalk-tempalte` is a single-character transposition of the popular `chalk-template` package (a top-tier npm u...
OpenSSF/OSV malware advisory MAL-2026-4517 blocks this version. Package name `chalk-tempalte` is a single-character transposition of the popular `chalk-template` package (a top-tier npm u...
OpenSSF/OSV malware advisory MAL-2026-4517 blocks this version. Package name `chalk-tempalte` is a single-character transposition of the popular `chalk-template` package (a top-tier npm u...
OpenSSF/OSV malware advisory MAL-2026-4517 blocks this version. Package name `chalk-tempalte` is a single-character transposition of the popular `chalk-template` package (a top-tier npm u...
OpenSSF/OSV malware advisory MAL-2026-4517 blocks this version. Package name `chalk-tempalte` is a single-character transposition of the popular `chalk-template` package (a top-tier npm u...
OpenSSF/OSV malware advisory MAL-2026-4517 blocks this version. Package name `chalk-tempalte` is a single-character transposition of the popular `chalk-template` package (a top-tier npm u...
OpenSSF/OSV malware advisory MAL-2026-5711 blocks this version. OSV/OpenSSF confirms chalk-pro@7.0.6 as malicious package MAL-2026-5711. Malicious code in chalk-pro (npm)
OpenSSF/OSV malware advisory MAL-2026-5711 blocks this version. OSV/OpenSSF confirms chalk-pro@7.0.4 as malicious package MAL-2026-5711. Malicious code in chalk-pro (npm)
OpenSSF/OSV malware advisory MAL-2026-5709 blocks this version. OSV/OpenSSF confirms chalk-plus-js@7.0.4 as malicious package MAL-2026-5709. Malicious code in chalk-plus-js (npm)
OpenSSF/OSV malware advisory MAL-2026-3754 blocks this version. Package is named `chalk-pack` (impersonating `chalk`) with keywords and `index.js` impersonating `lodash`; `index.js` is a...
OpenSSF/OSV malware advisory MAL-2026-3754 blocks this version. Package is named `chalk-pack` (impersonating `chalk`) with keywords and `index.js` impersonating `lodash`; `index.js` is a...
OpenSSF/OSV malware advisory MAL-2026-4233 blocks this version. Package name impersonates Chainlink branding while being published by an unrelated identity (author 'Web3 Developer Tools <...
OpenSSF/OSV malware advisory MAL-2026-4817 blocks this version. Package presents itself as a pino-compatible logger (README badges link to pinojs/pino, exports alias `module.exports.pino...
OpenSSF/OSV malware advisory MAL-2026-4516 blocks this version. chain-async-test impersonates the legitimate chain-async library (copies its README, license, author 'Eugene Lazutkin / uho...
OpenSSF/OSV malware advisory MAL-2026-4202 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4202 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4202 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4202 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4202 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4202 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4202 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4202 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...