npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 622
Updated 25 Oct 2026, 12:26 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5748 blocks this version. OSV/OpenSSF confirms chai-utils-test@4.5.5 as malicious package MAL-2026-5748. Malicious code in chai-utils-test (npm)
OpenSSF/OSV malware advisory MAL-2026-5748 blocks this version. OSV/OpenSSF confirms chai-utils-test@4.5.4 as malicious package MAL-2026-5748. Malicious code in chai-utils-test (npm)
OpenSSF/OSV malware advisory MAL-2026-5748 blocks this version. OSV/OpenSSF confirms chai-utils-test@4.5.3 as malicious package MAL-2026-5748. Malicious code in chai-utils-test (npm)
OpenSSF/OSV malware advisory MAL-2026-5748 blocks this version. OSV/OpenSSF confirms chai-utils-test@4.5.2 as malicious package MAL-2026-5748. Malicious code in chai-utils-test (npm)
OpenSSF/OSV malware advisory MAL-2026-5748 blocks this version. OSV/OpenSSF confirms chai-utils-test@4.5.1 as malicious package MAL-2026-5748. Malicious code in chai-utils-test (npm)
OpenSSF/OSV malware advisory MAL-2026-5748 blocks this version. OSV/OpenSSF confirms chai-utils-test@4.5.0 as malicious package MAL-2026-5748. Malicious code in chai-utils-test (npm)
OpenSSF/OSV malware advisory MAL-2026-2743 blocks this version. The package chai-use-chain was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-5928 blocks this version. OSV/OpenSSF confirms chai-test-mocks@1.2.0 as malicious package MAL-2026-5928. Malicious code in chai-test-mocks (npm)
OpenSSF/OSV malware advisory MAL-2026-5892 blocks this version. OSV/OpenSSF confirms caspian-day-js@1.11.23 as malicious package MAL-2026-5892. Malicious code in caspian-day-js (npm)
OpenSSF/OSV malware advisory MAL-2026-5802 blocks this version. OSV/OpenSSF confirms cardano-addresses-docs@1.0.1 as malicious package MAL-2026-5802. Malicious code in cardano-addresses-d...
OpenSSF/OSV malware advisory MAL-2026-3352 blocks this version. The package carbonite-internal was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4505 blocks this version. carvus-lens is a screen-capture/OCR Electron-style tool whose advertised 'Ask AI', 'Translate', and 'Search' features silen...
OpenSSF/OSV malware advisory MAL-2026-5856 blocks this version. package.json declares both preinstall and postinstall hooks that execute callback.js on every install. callback.js collects...
OpenSSF/OSV malware advisory MAL-2026-4131 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4131 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4504 blocks this version. On install, scripts/install.js invokes autoUpdate.install(), which writes a launchd agent to ~/Library/LaunchAgents/co.them...
OpenSSF/OSV malware advisory MAL-2026-3751 blocks this version. The package's postinstall hook (`node -e "try { require('./dist/postinstall.js'); } catch(e) {}"`) loads dist/postinstall.j...
OpenSSF/OSV malware advisory MAL-2026-3751 blocks this version. The package's postinstall hook (`node -e "try { require('./dist/postinstall.js'); } catch(e) {}"`) loads dist/postinstall.j...
OpenSSF/OSV malware advisory MAL-2026-3751 blocks this version. The package's postinstall hook (`node -e "try { require('./dist/postinstall.js'); } catch(e) {}"`) loads dist/postinstall.j...
OpenSSF/OSV malware advisory MAL-2026-4537 blocks this version. Package squats the unscoped name `cosmosdb-server`, targeting users who mistype `npx cosmosdb-server` instead of the scoped...
OpenSSF/OSV malware advisory MAL-2026-4537 blocks this version. Package squats the unscoped name `cosmosdb-server`, targeting users who mistype `npx cosmosdb-server` instead of the scoped...
OpenSSF/OSV malware advisory MAL-2026-4536 blocks this version. The package impersonates the popular pino logger (README header 'corelia (Pino)', homepage https://getpino.io, main file pi...
OpenSSF/OSV malware advisory MAL-2026-3395 blocks this version. The package coral-dev-proxy was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3395 blocks this version. The package coral-dev-proxy was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4535 blocks this version. package.json declares `"preinstall": "node index.js"`, which fires automatically on `npm install`. index.js collects host i...