npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 653
Updated 26 Oct 2026, 10:21 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-5561 blocks this version. OSV/OpenSSF confirms @bestlzk/sectest@1.0.0 as malicious package MAL-2026-5561. Malicious code in @bestlzk/sectest (npm)
OpenSSF/OSV malware advisory MAL-2026-3365 blocks this version. The package @b2bneo-rest/api-csf was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2025-6903 blocks this version. OSV/OpenSSF confirms @hornetsecurity/angular-search-box@18.0.0 as malicious package MAL-2025-6903. Malicious code in @horne...
OpenSSF/OSV malware advisory MAL-2026-5521 blocks this version. On `npm install`, the postinstall hook runs `node index.js`, which performs an HTTPS POST to `https://f1ackavab3.execute-ap...
OpenSSF/OSV malware advisory MAL-2026-6494 blocks this version. @help-forms/application-aff@3.4.3 ships a heavily obfuscated postinstall script (scripts/postinstall.js, obfuscator.io fing...
OpenSSF/OSV malware advisory MAL-2026-6140 blocks this version. @httpactions/strict-uri-encode impersonates the popular unscoped npm package 'strict-uri-encode' (~30M weekly downloads) by...
OpenSSF/OSV malware advisory MAL-2026-6139 blocks this version. The package ships a single heavily obfuscated index.js that performs no URL-encoding work despite the package name. On requ...
OpenSSF/OSV malware advisory MAL-2026-6139 blocks this version. The package ships a single heavily obfuscated index.js that performs no URL-encoding work despite the package name. On requ...
OpenSSF/OSV malware advisory MAL-2026-4265 blocks this version. @asavie/i18n@99.0.0 is a dependency-confusion package targeting an unclaimed npm scope. Its package.json declares a `preins...
OpenSSF/OSV malware advisory MAL-2026-4265 blocks this version. @asavie/i18n@99.0.0 is a dependency-confusion package targeting an unclaimed npm scope. Its package.json declares a `preins...
OpenSSF/OSV malware advisory MAL-2026-4265 blocks this version. @asavie/i18n@99.0.0 is a dependency-confusion package targeting an unclaimed npm scope. Its package.json declares a `preins...
OpenSSF/OSV malware advisory MAL-2026-4160 blocks this version. The package @apps-home-dashboard/events was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6211 blocks this version. @apiwizards/auth-middleware@5.1.2 ships a single heavily obfuscated index.js (obfuscator.io string-array with 317 entries,...
OpenSSF/OSV malware advisory MAL-2026-6211 blocks this version. @apiwizards/auth-middleware@5.1.2 ships a single heavily obfuscated index.js (obfuscator.io string-array with 317 entries,...
OpenSSF/OSV malware advisory MAL-2026-3989 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-3989 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-3988 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...