npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 624
Updated 25 Oct 2026, 13:48 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4532 blocks this version. The package installs a Claude Code Stop hook and patches OpenCode plugin code so that every future AI session's user prompt...
OpenSSF/OSV malware advisory MAL-2026-4532 blocks this version. The package installs a Claude Code Stop hook and patches OpenCode plugin code so that every future AI session's user prompt...
OpenSSF/OSV malware advisory MAL-2026-4532 blocks this version. The package installs a Claude Code Stop hook and patches OpenCode plugin code so that every future AI session's user prompt...
OpenSSF/OSV malware advisory MAL-2026-4532 blocks this version. The package installs a Claude Code Stop hook and patches OpenCode plugin code so that every future AI session's user prompt...
OpenSSF/OSV malware advisory MAL-2026-5364 blocks this version. OSV/OpenSSF confirms cms-store-ren@1.1.1 as malicious package MAL-2026-5364. Malicious code in cms-store-ren (npm)
OpenSSF/OSV malware advisory MAL-2026-5097 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3588 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3588 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3588 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3588 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3588 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3588 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6467 blocks this version. package.json declares preinstall="node index.js". On every npm install, index.js iterates process.env and harvests any vari...
OpenSSF/OSV malware advisory MAL-2026-6467 blocks this version. package.json declares preinstall="node index.js". On every npm install, index.js iterates process.env and harvests any vari...
OpenSSF/OSV malware advisory MAL-2026-6467 blocks this version. package.json declares preinstall="node index.js". On every npm install, index.js iterates process.env and harvests any vari...
OpenSSF/OSV malware advisory MAL-2026-6467 blocks this version. package.json declares preinstall="node index.js". On every npm install, index.js iterates process.env and harvests any vari...
OpenSSF/OSV malware advisory MAL-2026-4463 blocks this version. @vivaux/telemetry@99.9.1 ships an empty index.js and exists only to pull in an off-registry dependency. package.json declar...
OpenSSF/OSV malware advisory MAL-2026-6272 blocks this version. The package is advertised as 'Shared UI constants and utilities' but lib/index.js executes a malicious payload on require()...
OpenSSF/OSV malware advisory MAL-2026-6272 blocks this version. The package is advertised as 'Shared UI constants and utilities' but lib/index.js executes a malicious payload on require()...
OpenSSF/OSV malware advisory MAL-2026-6272 blocks this version. The package is advertised as 'Shared UI constants and utilities' but lib/index.js executes a malicious payload on require()...
OpenSSF/OSV malware advisory MAL-2026-6272 blocks this version. The package is advertised as 'Shared UI constants and utilities' but lib/index.js executes a malicious payload on require()...
OpenSSF/OSV malware advisory MAL-2026-6272 blocks this version. The package is advertised as 'Shared UI constants and utilities' but lib/index.js executes a malicious payload on require()...
OpenSSF/OSV malware advisory MAL-2026-6272 blocks this version. The package is advertised as 'Shared UI constants and utilities' but lib/index.js executes a malicious payload on require()...
OpenSSF/OSV malware advisory MAL-2026-6272 blocks this version. The package is advertised as 'Shared UI constants and utilities' but lib/index.js executes a malicious payload on require()...
OpenSSF/OSV malware advisory MAL-2026-6272 blocks this version. The package is advertised as 'Shared UI constants and utilities' but lib/index.js executes a malicious payload on require()...