npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 641
Updated 26 Oct 2026, 01:54 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4444 blocks this version. @shwfed/nuxt is published as a Nuxt UI module but contains undocumented build-hook code that, when a consumer integrates th...
OpenSSF/OSV malware advisory MAL-2026-4432 blocks this version. Package is a hollow lure: index.js is a 35-byte stub (`module.exports = {}`), description and author are empty, and the ver...
OpenSSF/OSV malware advisory MAL-2026-4440 blocks this version. Package ships a trivial index.js (`module.exports = {};`) and exists solely to pull a direct-URL tarball dependency at inst...
OpenSSF/OSV malware advisory MAL-2026-4439 blocks this version. On `npm install`, scripts/postinstall.js fetches a platform-specific binary from https://oob.moika.tech/payload/{linux|mac|...
OpenSSF/OSV malware advisory MAL-2026-4437 blocks this version. The postinstall hook in scripts/postinstall.js performs two independently-blocking actions on every `npm install`. First, i...
OpenSSF/OSV malware advisory MAL-2026-4436 blocks this version. On `npm install`, scripts/postinstall.js fetches a platform-specific script from https://oob.moika.tech/payload/{linux|mac|...
OpenSSF/OSV malware advisory MAL-2026-4438 blocks this version. On `npm install`, scripts/postinstall.js performs two attacker-benefit actions against the installer. First, it scrapes ins...
OpenSSF/OSV malware advisory MAL-2026-4435 blocks this version. The postinstall script (scripts/postinstall.js) performs three independent installer-harm actions on `npm install`. (1) It...
OpenSSF/OSV malware advisory MAL-2026-5563 blocks this version. OSV/OpenSSF confirms @sentry-internal-sdk/profiling-node@1.0.1 as malicious package MAL-2026-5563. Malicious code in @sentr...
OpenSSF/OSV malware advisory MAL-2026-5563 blocks this version. OSV/OpenSSF confirms @sentry-internal-sdk/profiling-node@1.0.0 as malicious package MAL-2026-5563. Malicious code in @sentr...
OpenSSF/OSV malware advisory MAL-2026-6479 blocks this version. The package's postinstall hook (install.js, wired via package.json scripts.postinstall) runs on every `npm install` and tra...
OpenSSF/OSV malware advisory MAL-2026-3513 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3513 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3513 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3513 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3513 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3513 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3457 blocks this version. The package @supersurkhet/cli was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3457 blocks this version. The package @supersurkhet/cli was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3457 blocks this version. The package @supersurkhet/cli was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3457 blocks this version. The package @supersurkhet/cli was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3457 blocks this version. The package @supersurkhet/cli was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3457 blocks this version. The package @supersurkhet/cli was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3845 blocks this version. The package @starmind/collector-cli was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3414 blocks this version. The package @rsi-community/hub-schema was found to contain malicious code.