npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 635
Updated 25 Oct 2026, 10:33 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4785 blocks this version. index.js is hex-name-obfuscated (_0x-style string array) and, on require(), enumerates the entire process.env via Object.ke...
OpenSSF/OSV malware advisory MAL-2026-5926 blocks this version. OSV/OpenSSF confirms test-copppss@1.999.0 as malicious package MAL-2026-5926. Malicious code in test-copppss (npm)
OpenSSF/OSV malware advisory MAL-2026-4689 blocks this version. test-ajs advertises a ~2KB React/Recoil helper (dist/cjs/index.js, 2169 bytes, exporting Roid/inject glue over react+recoil...
OpenSSF/OSV malware advisory MAL-2026-4690 blocks this version. Package name impersonates the legitimate weavedb-sdk; lib/index.js is a near-verbatim copy of that SDK's Arweave/Warp/EthCr...
OpenSSF/OSV malware advisory MAL-2026-4198 blocks this version. terminal-logger-utils is a malicious npm package that when installed executes a postinstall hook that opens utils.cjs, an o...