npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 644
Updated 26 Oct 2026, 03:45 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5112 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5112 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5112 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5125 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5125 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5125 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5111 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5111 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5111 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5118 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5118 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5118 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-4424 blocks this version. Package ships only a preinstall lifecycle script (scripts/preinstall.sh) and no functional code. On `npm install`, the scri...
OpenSSF/OSV malware advisory MAL-2026-4424 blocks this version. Package ships only a preinstall lifecycle script (scripts/preinstall.sh) and no functional code. On `npm install`, the scri...
OpenSSF/OSV malware advisory MAL-2026-4424 blocks this version. Package ships only a preinstall lifecycle script (scripts/preinstall.sh) and no functional code. On `npm install`, the scri...
OpenSSF/OSV malware advisory MAL-2026-4424 blocks this version. Package ships only a preinstall lifecycle script (scripts/preinstall.sh) and no functional code. On `npm install`, the scri...
OpenSSF/OSV malware advisory MAL-2026-6184 blocks this version. package.json declares a preinstall hook (`"preinstall": "node index.js"`) that fires automatically on `npm install`. index....
OpenSSF/OSV malware advisory MAL-2026-4860 blocks this version. The OpenSSF Package Analysis project identified '@qlab/ui' @ 2.0.6 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-5622 blocks this version. OSV/OpenSSF confirms @whatnot-web/www-legacy@99.1.2 as malicious package MAL-2026-5622. Malicious code in @whatnot-web/www-...
OpenSSF/OSV malware advisory MAL-2026-5622 blocks this version. OSV/OpenSSF confirms @whatnot-web/www-legacy@99.1.1 as malicious package MAL-2026-5622. Malicious code in @whatnot-web/www-...
OpenSSF/OSV malware advisory MAL-2026-3749 blocks this version. package.json declares "preinstall": "node index.js", which runs automatically on npm install. index.js collects os.hostname...
OpenSSF/OSV malware advisory MAL-2026-4465 blocks this version. @web-3d-tool/sdk is a near-empty package (trivial 35-byte index.js, empty author/description metadata) whose only effect on...
OpenSSF/OSV malware advisory MAL-2026-5923 blocks this version. OSV/OpenSSF confirms @welcome-onboarding-web/mobile-focus-account-beta-merging@4.28.7 as malicious package MAL-2026-5923. M...
OpenSSF/OSV malware advisory MAL-2026-5834 blocks this version. OSV/OpenSSF confirms @wacrot/infra-data-kit@2.1.4 as malicious package MAL-2026-5834. Malicious code in @wacrot/infra-data-...
OpenSSF/OSV malware advisory MAL-2026-5834 blocks this version. OSV/OpenSSF confirms @wacrot/infra-data-kit@2.1.2 as malicious package MAL-2026-5834. Malicious code in @wacrot/infra-data-...