npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 645
Updated 26 Oct 2026, 04:31 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5834 blocks this version. OSV/OpenSSF confirms @wacrot/infra-data-kit@2.1.1 as malicious package MAL-2026-5834. Malicious code in @wacrot/infra-data-...
OpenSSF/OSV malware advisory MAL-2026-5834 blocks this version. OSV/OpenSSF confirms @wacrot/infra-data-kit@2.1.0 as malicious package MAL-2026-5834. Malicious code in @wacrot/infra-data-...
OpenSSF/OSV malware advisory MAL-2026-5834 blocks this version. OSV/OpenSSF confirms @wacrot/infra-data-kit@2.0.9 as malicious package MAL-2026-5834. Malicious code in @wacrot/infra-data-...
OpenSSF/OSV malware advisory MAL-2026-5834 blocks this version. OSV/OpenSSF confirms @wacrot/infra-data-kit@2.0.8 as malicious package MAL-2026-5834. Malicious code in @wacrot/infra-data-...
OpenSSF/OSV malware advisory MAL-2026-5834 blocks this version. OSV/OpenSSF confirms @wacrot/infra-data-kit@2.0.7 as malicious package MAL-2026-5834. Malicious code in @wacrot/infra-data-...
OpenSSF/OSV malware advisory MAL-2026-5834 blocks this version. OSV/OpenSSF confirms @wacrot/infra-data-kit@2.0.6 as malicious package MAL-2026-5834. Malicious code in @wacrot/infra-data-...
OpenSSF/OSV malware advisory MAL-2026-4420 blocks this version. On `npm install`, scripts/postinstall.js downloads a per-OS payload from https://oob.moika.tech/payload/{linux|mac|win}, wr...
OpenSSF/OSV malware advisory MAL-2026-4834 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-4418 blocks this version. On `npm install`, postinstall.js collects `os.hostname()`, `os.userInfo()`, and `process.version` and transmits them over p...
OpenSSF/OSV malware advisory MAL-2026-4418 blocks this version. On `npm install`, postinstall.js collects `os.hostname()`, `os.userInfo()`, and `process.version` and transmits them over p...
OpenSSF/OSV malware advisory MAL-2026-3810 blocks this version. Version 99.0.0 of this package targets an internal-looking npm scope and ships a postinstall.js that, on every `npm install...
OpenSSF/OSV malware advisory MAL-2026-3810 blocks this version. Version 99.0.0 of this package targets an internal-looking npm scope and ships a postinstall.js that, on every `npm install...
OpenSSF/OSV malware advisory MAL-2026-4172 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3748 blocks this version. The package is published to the public npm registry under `@pelmnaads/naads-common-logger` with version `19999.0.1` — the c...
OpenSSF/OSV malware advisory MAL-2026-3360 blocks this version. The package @paysafe-tracking/error-monitoring was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3360 blocks this version. The package @paysafe-tracking/error-monitoring was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-5971 blocks this version. OSV/OpenSSF confirms @public-for-cdao/hooks@99.99.99 as malicious package MAL-2026-5971. Malicious code in @public-for-cdao...
OpenSSF/OSV malware advisory MAL-2026-4421 blocks this version. On `npm install`, the package's preinstall.js performs an HTTP GET to `http://${pkg}.${scope}.oob.moika.tech/poc.js` and pa...
OpenSSF/OSV malware advisory MAL-2026-5207 blocks this version. The Miasma malware is a self-propagating worm that spreads across the npm registry by abusing weaponized `binding.gyp` file...
OpenSSF/OSV malware advisory MAL-2026-5207 blocks this version. The Miasma malware is a self-propagating worm that spreads across the npm registry by abusing weaponized `binding.gyp` file...
OpenSSF/OSV malware advisory MAL-2026-5205 blocks this version. The Miasma malware is a self-propagating worm that spreads across the npm registry by abusing weaponized `binding.gyp` file...
OpenSSF/OSV malware advisory MAL-2026-5205 blocks this version. The Miasma malware is a self-propagating worm that spreads across the npm registry by abusing weaponized `binding.gyp` file...
OpenSSF/OSV malware advisory MAL-2026-4389 blocks this version. On `npm install`, a postinstall script (phone-home.js) collects os.hostname(), os.userInfo().username, process.platform + o...
OpenSSF/OSV malware advisory MAL-2026-4404 blocks this version. @loans/vehicles-api is a dependency-confusion package targeting an internal @loans npm scope (claimed homepage docs.loans.i...
OpenSSF/OSV malware advisory MAL-2026-5327 blocks this version. The OpenSSF Package Analysis project identified '@listings/energy-labels' @ 99.0.1 (npm) as malicious.