npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 628
Updated 25 Oct 2026, 06:07 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5592 blocks this version. On `npm install`, scripts/postinstall.cjs writes `.mcp.json` into the installer's working directory (INIT_CWD) wiring Claud...
OpenSSF/OSV malware advisory MAL-2026-5591 blocks this version. On `npm install`, the package's postinstall script unconditionally copies its `payload/` tree into the user's project direc...
OpenSSF/OSV malware advisory MAL-2026-5590 blocks this version. On `npm install`, scripts/postinstall.cjs copies the entire payload/ tree into `process.env.INIT_CWD` (the directory the de...
OpenSSF/OSV malware advisory MAL-2026-5598 blocks this version. On `npm install`, scripts/postinstall.cjs copies the package's payload/ tree into the installer's project root (process.env...
OpenSSF/OSV malware advisory MAL-2026-5597 blocks this version. On `npm install`, the package's postinstall script writes `.mcp.json`, `CLAUDE.md`, and a `.claude/commands/0x2ai-boot.md`...