npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 649
Updated 26 Oct 2026, 07:22 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5546 blocks this version. OSV/OpenSSF confirms @common-stack/generate-plugin@9.0.5-alpha.0 as malicious package MAL-2026-5546. Malicious code in @com...
OpenSSF/OSV malware advisory MAL-2026-5546 blocks this version. OSV/OpenSSF confirms @common-stack/generate-plugin@9.0.4-alpha.1 as malicious package MAL-2026-5546. Malicious code in @com...
OpenSSF/OSV malware advisory MAL-2026-5546 blocks this version. OSV/OpenSSF confirms @common-stack/generate-plugin@9.0.4-alpha.0 as malicious package MAL-2026-5546. Malicious code in @com...
OpenSSF/OSV malware advisory MAL-2026-5546 blocks this version. OSV/OpenSSF confirms @common-stack/generate-plugin@9.0.2-alpha.24 as malicious package MAL-2026-5546. Malicious code in @co...
OpenSSF/OSV malware advisory MAL-2026-5546 blocks this version. OSV/OpenSSF confirms @common-stack/generate-plugin@9.0.2-alpha.23 as malicious package MAL-2026-5546. Malicious code in @co...
OpenSSF/OSV malware advisory MAL-2026-5546 blocks this version. OSV/OpenSSF confirms @common-stack/generate-plugin@9.0.2-alpha.22 as malicious package MAL-2026-5546. Malicious code in @co...
OpenSSF/OSV malware advisory MAL-2026-5546 blocks this version. OSV/OpenSSF confirms @common-stack/generate-plugin@9.0.2-alpha.21 as malicious package MAL-2026-5546. Malicious code in @co...
OpenSSF/OSV malware advisory MAL-2026-5546 blocks this version. OSV/OpenSSF confirms @common-stack/generate-plugin@10.0.1-alpha.0 as malicious package MAL-2026-5546. Malicious code in @co...
OpenSSF/OSV malware advisory MAL-2026-5195 blocks this version. The Miasma malware is a self-propagating worm that spreads across the npm registry by abusing weaponized `binding.gyp` file...
OpenSSF/OSV malware advisory MAL-2026-6464 blocks this version. scripts/postinstall.js is registered as the npm `postinstall` lifecycle script and is heavily packed with obfuscator.io str...
OpenSSF/OSV malware advisory MAL-2026-3057 blocks this version. The package @clearpool/streaming was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3057 blocks this version. The package @clearpool/streaming was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3057 blocks this version. The package @clearpool/streaming was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3056 blocks this version. The package @clearpool/comms was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3056 blocks this version. The package @clearpool/comms was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3056 blocks this version. The package @clearpool/comms was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3059 blocks this version. package.json declares `preinstall` and `install` lifecycle hooks that collect installer-identifying data (`whoami`, `hostna...
OpenSSF/OSV malware advisory MAL-2026-3059 blocks this version. package.json declares `preinstall` and `install` lifecycle hooks that collect installer-identifying data (`whoami`, `hostna...
OpenSSF/OSV malware advisory MAL-2026-3059 blocks this version. package.json declares `preinstall` and `install` lifecycle hooks that collect installer-identifying data (`whoami`, `hostna...
OpenSSF/OSV malware advisory MAL-2026-3058 blocks this version. The package @clearpool/table was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3058 blocks this version. The package @clearpool/table was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3058 blocks this version. The package @clearpool/table was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4257 blocks this version. The OpenSSF Package Analysis project identified '@cloudways-lab/unified-design-system' @ 99.9.1 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-6069 blocks this version. The package declares `"preinstall": "node index.js"` in package.json, causing index.js to execute automatically on `npm ins...
OpenSSF/OSV malware advisory MAL-2026-6069 blocks this version. The package declares `"preinstall": "node index.js"` in package.json, causing index.js to execute automatically on `npm ins...