npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 621
Updated 25 Oct 2026, 11:45 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5526 blocks this version. OSV/OpenSSF confirms chai-check-error@2.1.8 as malicious package MAL-2026-5526. Malicious code in chai-check-error (npm)
OpenSSF/OSV malware advisory MAL-2026-5526 blocks this version. OSV/OpenSSF confirms chai-check-error@2.1.7 as malicious package MAL-2026-5526. Malicious code in chai-check-error (npm)
OpenSSF/OSV malware advisory MAL-2026-5526 blocks this version. OSV/OpenSSF confirms chai-check-error@2.1.6 as malicious package MAL-2026-5526. Malicious code in chai-check-error (npm)
OpenSSF/OSV malware advisory MAL-2026-5526 blocks this version. OSV/OpenSSF confirms chai-check-error@2.1.5 as malicious package MAL-2026-5526. Malicious code in chai-check-error (npm)
OpenSSF/OSV malware advisory MAL-2026-5526 blocks this version. OSV/OpenSSF confirms chai-check-error@2.1.3 as malicious package MAL-2026-5526. Malicious code in chai-check-error (npm)
OpenSSF/OSV malware advisory MAL-2026-4512 blocks this version. Package name 'chai-as-repaired' is a 1-edit typosquat of the popular 'chai-as-promised' chai plugin (>1M weekly downloads)....
OpenSSF/OSV malware advisory MAL-2026-4512 blocks this version. Package name 'chai-as-repaired' is a 1-edit typosquat of the popular 'chai-as-promised' chai plugin (>1M weekly downloads)....
OpenSSF/OSV malware advisory MAL-2026-3753 blocks this version. Package is published as `chai-as-regulated`, a name mimicking the widely-used `chai-as-promised` Chai plugin, and the READM...
OpenSSF/OSV malware advisory MAL-2026-4511 blocks this version. This package is a typosquat of chai-as-promised that delivers remote code execution to any installer that requires it and i...
OpenSSF/OSV malware advisory MAL-2026-6393 blocks this version. Package name 'chai-as-predicted' impersonates the popular 'chai-as-promised' assertion library, but ships unrelated code di...
OpenSSF/OSV malware advisory MAL-2026-6350 blocks this version. Package name impersonates the widely-used `chai-as-promised` (README instructs `chai.use(chaiAsOperated)`) and the README b...
OpenSSF/OSV malware advisory MAL-2026-6219 blocks this version. Package name impersonates the popular chai-as-promised assertion library, but its package.json description and keywords are...
OpenSSF/OSV malware advisory MAL-2026-6465 blocks this version. chai-as-built masquerades as the pino logger (package.json keywords 'fast','logger','stream','json'; file layout lib/proto....
OpenSSF/OSV malware advisory MAL-2026-6218 blocks this version. Package impersonates a pino-style logger (exports `module.exports.pino`, ships pino-like `DEFAULT_LEVELS`, keywords `fast/l...
OpenSSF/OSV malware advisory MAL-2026-4514 blocks this version. The package masquerades as a pino-style logger (exports `module.exports.pino = middleware`, keywords `fast,logger,stream,js...
OpenSSF/OSV malware advisory MAL-2026-5605 blocks this version. OSV/OpenSSF confirms chai-as-victimed@6.1.21 as malicious package MAL-2026-5605. Malicious code in chai-as-victimed (npm)
OpenSSF/OSV malware advisory MAL-2026-6220 blocks this version. Package name impersonates the popular `chai-as-promised` library, but its package.json description and keywords masquerade...
OpenSSF/OSV malware advisory MAL-2026-2740 blocks this version. chai-as-type is a malicious npm package that when imported downloads a C2 dropper from https://api.npoint[.]io/c26313f07339...
OpenSSF/OSV malware advisory MAL-2026-2740 blocks this version. chai-as-type is a malicious npm package that when imported downloads a C2 dropper from https://api.npoint[.]io/c26313f07339...
OpenSSF/OSV malware advisory MAL-2026-4513 blocks this version. Package name `chai-as-tuned` impersonates `chai-as-promised` and ships a README copy-pasted from the unrelated pino project...
OpenSSF/OSV malware advisory MAL-2026-5902 blocks this version. OSV/OpenSSF confirms chai-as-tokenized@7.2.3 as malicious package MAL-2026-5902. Malicious code in chai-as-tokenized (npm)
OpenSSF/OSV malware advisory MAL-2026-6221 blocks this version. Package name and metadata impersonate the 'chai' assertion library (reuses chai's contributors, description, and a 'chaiass...
OpenSSF/OSV malware advisory MAL-2026-5699 blocks this version. OSV/OpenSSF confirms chai-web3-testkit@1.0.1 as malicious package MAL-2026-5699. Malicious code in chai-web3-testkit (npm)
OpenSSF/OSV malware advisory MAL-2026-4515 blocks this version. The package masquerades as a pino-logger helper (file structure, exports, and keywords are copied from pino) but its main e...
OpenSSF/OSV malware advisory MAL-2026-5748 blocks this version. OSV/OpenSSF confirms chai-utils-test@4.5.5 as malicious package MAL-2026-5748. Malicious code in chai-utils-test (npm)