npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 623
Updated 25 Oct 2026, 13:08 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5297 blocks this version. The OpenSSF Package Analysis project identified 'consumerweb-authflow' @ 4.1.1 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-5297 blocks this version. The OpenSSF Package Analysis project identified 'consumerweb-authflow' @ 4.1.1 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-3417 blocks this version. The package connect-perspectives-admintool was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6131 blocks this version. The package impersonates the well-known babel-preset-react-app under a fake org-style prefix and ships no Babel preset code...
OpenSSF/OSV malware advisory MAL-2026-4234 blocks this version. On `npm install`, the package's `postinstall` hook runs `npx env-security-scanner@latest audit_environment` via `child_proc...
OpenSSF/OSV malware advisory MAL-2026-3308 blocks this version. The package common-roles was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4175 blocks this version. The package.json declares a postinstall lifecycle hook that performs reconnaissance and exfiltration on every install. The...
OpenSSF/OSV malware advisory MAL-2026-4175 blocks this version. The package.json declares a postinstall lifecycle hook that performs reconnaissance and exfiltration on every install. The...
OpenSSF/OSV malware advisory MAL-2026-4175 blocks this version. The package.json declares a postinstall lifecycle hook that performs reconnaissance and exfiltration on every install. The...
OpenSSF/OSV malware advisory MAL-2026-4175 blocks this version. The package.json declares a postinstall lifecycle hook that performs reconnaissance and exfiltration on every install. The...
OpenSSF/OSV malware advisory MAL-2026-6089 blocks this version. package.json declares a postinstall hook (`"postinstall": "node run.js"`) that automatically runs run.js on `npm install`....
OpenSSF/OSV malware advisory MAL-2026-4534 blocks this version. On `npm install`, all three lifecycle hooks (preinstall, install, postinstall) execute postinstall.js, which harvests insta...
OpenSSF/OSV malware advisory MAL-2026-4534 blocks this version. On `npm install`, all three lifecycle hooks (preinstall, install, postinstall) execute postinstall.js, which harvests insta...
OpenSSF/OSV malware advisory MAL-2026-4534 blocks this version. On `npm install`, all three lifecycle hooks (preinstall, install, postinstall) execute postinstall.js, which harvests insta...
OpenSSF/OSV malware advisory MAL-2026-4534 blocks this version. On `npm install`, all three lifecycle hooks (preinstall, install, postinstall) execute postinstall.js, which harvests insta...
OpenSSF/OSV malware advisory MAL-2026-4534 blocks this version. On `npm install`, all three lifecycle hooks (preinstall, install, postinstall) execute postinstall.js, which harvests insta...
OpenSSF/OSV malware advisory MAL-2026-4534 blocks this version. On `npm install`, all three lifecycle hooks (preinstall, install, postinstall) execute postinstall.js, which harvests insta...
OpenSSF/OSV malware advisory MAL-2026-5610 blocks this version. OSV/OpenSSF confirms coderzero@1.0.4 as malicious package MAL-2026-5610. Malicious code in coderzero (npm)
OpenSSF/OSV malware advisory MAL-2026-5610 blocks this version. OSV/OpenSSF confirms coderzero@1.0.3 as malicious package MAL-2026-5610. Malicious code in coderzero (npm)
OpenSSF/OSV malware advisory MAL-2026-5610 blocks this version. OSV/OpenSSF confirms coderzero@1.0.2 as malicious package MAL-2026-5610. Malicious code in coderzero (npm)
OpenSSF/OSV malware advisory MAL-2026-5610 blocks this version. OSV/OpenSSF confirms coderzero@1.0.1 as malicious package MAL-2026-5610. Malicious code in coderzero (npm)
OpenSSF/OSV malware advisory MAL-2026-5610 blocks this version. OSV/OpenSSF confirms coderzero@1.0.0 as malicious package MAL-2026-5610. Malicious code in coderzero (npm)
OpenSSF/OSV malware advisory MAL-2026-3232 blocks this version. The package codewhisperer-streaming was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4532 blocks this version. The package installs a Claude Code Stop hook and patches OpenCode plugin code so that every future AI session's user prompt...
OpenSSF/OSV malware advisory MAL-2026-4532 blocks this version. The package installs a Claude Code Stop hook and patches OpenCode plugin code so that every future AI session's user prompt...