npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 645
Updated 25 Oct 2026, 17:24 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4635 blocks this version. On `npm install`, preinstall.js collects hostname, username, platform, cwd, timestamp, and a full dump of os.networkInterfa...
OpenSSF/OSV malware advisory MAL-2026-5989 blocks this version. pathfix presents itself as a Stylus port of normalize.css but ships a copy of the unrelated normalize-path module with an a...
OpenSSF/OSV malware advisory MAL-2026-5989 blocks this version. pathfix presents itself as a Stylus port of normalize.css but ships a copy of the unrelated normalize-path module with an a...
OpenSSF/OSV malware advisory MAL-2026-5989 blocks this version. pathfix presents itself as a Stylus port of normalize.css but ships a copy of the unrelated normalize-path module with an a...
OpenSSF/OSV malware advisory MAL-2026-2930 blocks this version. The package presents itself as a copy of the Node.js core `path` module (name `path-internal`, README: "exact copy of the N...