npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 666
Updated 26 Oct 2026, 08:23 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4581 blocks this version. The package ships shared/keys.json containing 9 AES-256-GCM-encrypted Groq API keys. The decryption key is a fixed byte seq...
OpenSSF/OSV malware advisory MAL-2026-4581 blocks this version. The package ships shared/keys.json containing 9 AES-256-GCM-encrypted Groq API keys. The decryption key is a fixed byte seq...
OpenSSF/OSV malware advisory MAL-2026-3649 blocks this version. Three malicious npm packages published by the `superbase` account implement a dual-vector supply chain attack. Each package...
OpenSSF/OSV malware advisory MAL-2026-4584 blocks this version. The package exports a VelocityAuth() function that, when called by integrating applications, sends end-user Solana wallet p...
OpenSSF/OSV malware advisory MAL-2026-4583 blocks this version. package.json declares a preinstall lifecycle hook that runs `wget --quiet "https://webhook.site/64063d25-fcd3-44e5-a454-348...