npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 650
Updated 26 Oct 2026, 07:57 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6069 blocks this version. The package declares `"preinstall": "node index.js"` in package.json, causing index.js to execute automatically on `npm ins...
OpenSSF/OSV malware advisory MAL-2026-6069 blocks this version. The package declares `"preinstall": "node index.js"` in package.json, causing index.js to execute automatically on `npm ins...
OpenSSF/OSV malware advisory MAL-2026-4256 blocks this version. The OpenSSF Package Analysis project identified '@citi-icg-171632/citicms-repo-component' @ 99.9.1 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-3808 blocks this version. The package @citi-icg-158830/icgds-react-css was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3806 blocks this version. The package @citi-icg-158830/elemental-chameleon was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3806 blocks this version. The package @citi-icg-158830/elemental-chameleon was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3807 blocks this version. The package @citi-icg-158830/elemental-ui-react was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3807 blocks this version. The package @citi-icg-158830/elemental-ui-react was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-5095 blocks this version. The OpenSSF Package Analysis project identified '@challenger6/vm-pattern-library' @ 99.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-3682 blocks this version. The package's postinstall script (package.json line 10: "postinstall": "node install.js") unconditionally fetches a platfor...
OpenSSF/OSV malware advisory MAL-2026-3336 blocks this version. The package @channel_bot/xa0 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3681 blocks this version. The package declares a postinstall lifecycle hook (`"postinstall": "node postinstall.js"` in package.json) that runs automa...
OpenSSF/OSV malware advisory MAL-2026-6521 blocks this version. package.json declares a preinstall hook (`node index.js`) that runs unconditionally on `npm install`. index.js imports chil...
OpenSSF/OSV malware advisory MAL-2026-4161 blocks this version. The package @cap-js/openapi was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6120 blocks this version. The package ships setup.cjs containing heavily obfuscated JavaScript with hex-mangled identifiers (_0x32549a, _0x4b2b44, _0...
OpenSSF/OSV malware advisory MAL-2026-3256 blocks this version. Dependency confusion and typosquatting campaign by threat actor "saif777". Packages use inflated version numbers (9999.9999...
OpenSSF/OSV malware advisory MAL-2026-6529 blocks this version. The package ships a binding.gyp at the package root containing GYP command-expansion syntax (`<!(...)`) in its sources/targ...
OpenSSF/OSV malware advisory MAL-2026-6529 blocks this version. The package ships a binding.gyp at the package root containing GYP command-expansion syntax (`<!(...)`) in its sources/targ...
OpenSSF/OSV malware advisory MAL-2026-6529 blocks this version. The package ships a binding.gyp at the package root containing GYP command-expansion syntax (`<!(...)`) in its sources/targ...
OpenSSF/OSV malware advisory MAL-2026-6529 blocks this version. The package ships a binding.gyp at the package root containing GYP command-expansion syntax (`<!(...)`) in its sources/targ...
OpenSSF/OSV malware advisory MAL-2026-6529 blocks this version. The package ships a binding.gyp at the package root containing GYP command-expansion syntax (`<!(...)`) in its sources/targ...
OpenSSF/OSV malware advisory MAL-2026-6528 blocks this version. The package ships a binding.gyp at the tarball root that contains GYP command-expansion syntax (<!(...) / <!@(...)) in its...
OpenSSF/OSV malware advisory MAL-2026-6528 blocks this version. The package ships a binding.gyp at the tarball root that contains GYP command-expansion syntax (<!(...) / <!@(...)) in its...
OpenSSF/OSV malware advisory MAL-2026-6528 blocks this version. The package ships a binding.gyp at the tarball root that contains GYP command-expansion syntax (<!(...) / <!@(...)) in its...
OpenSSF/OSV malware advisory MAL-2026-6528 blocks this version. The package ships a binding.gyp at the tarball root that contains GYP command-expansion syntax (<!(...) / <!@(...)) in its...