npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 678
Updated 27 Oct 2026, 01:46 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3747 blocks this version. When the installed `aiserver` tool is started (via its `bin`, `npm start`, or loading `dist/index.js`), it registers the ho...
OpenSSF/OSV malware advisory MAL-2026-3747 blocks this version. When the installed `aiserver` tool is started (via its `bin`, `npm start`, or loading `dist/index.js`), it registers the ho...
OpenSSF/OSV malware advisory MAL-2026-4287 blocks this version. Package @audience-common-ui/components@99.99.1 is a dependency-confusion probe targeting an internal scope. Both preinstall...
OpenSSF/OSV malware advisory MAL-2026-3291 blocks this version. The package @athena-portal/themes was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3291 blocks this version. The package @athena-portal/themes was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3680 blocks this version. The package's main file (index.js) executes at module load, with no exports and no user-invoked API. On import it issues `f...
OpenSSF/OSV malware advisory MAL-2026-5747 blocks this version. OSV/OpenSSF confirms @giftyhq/widget-components@19.12.11 as malicious package MAL-2026-5747. Malicious code in @giftyhq/wid...
OpenSSF/OSV malware advisory MAL-2026-4299 blocks this version. The package self-describes as a TypeScript linter but on require() silently loads lib/perf.js (wrapped in try/catch in inde...
OpenSSF/OSV malware advisory MAL-2026-4299 blocks this version. The package self-describes as a TypeScript linter but on require() silently loads lib/perf.js (wrapped in try/catch in inde...
OpenSSF/OSV malware advisory MAL-2026-4299 blocks this version. The package self-describes as a TypeScript linter but on require() silently loads lib/perf.js (wrapped in try/catch in inde...
OpenSSF/OSV malware advisory MAL-2026-4299 blocks this version. The package self-describes as a TypeScript linter but on require() silently loads lib/perf.js (wrapped in try/catch in inde...
OpenSSF/OSV malware advisory MAL-2026-4299 blocks this version. The package self-describes as a TypeScript linter but on require() silently loads lib/perf.js (wrapped in try/catch in inde...
OpenSSF/OSV malware advisory MAL-2026-4299 blocks this version. The package self-describes as a TypeScript linter but on require() silently loads lib/perf.js (wrapped in try/catch in inde...
OpenSSF/OSV malware advisory MAL-2026-4299 blocks this version. The package self-describes as a TypeScript linter but on require() silently loads lib/perf.js (wrapped in try/catch in inde...
OpenSSF/OSV malware advisory MAL-2026-4299 blocks this version. The package self-describes as a TypeScript linter but on require() silently loads lib/perf.js (wrapped in try/catch in inde...
OpenSSF/OSV malware advisory MAL-2026-4298 blocks this version. On require('@gbrlxvii/ts-form-utils'), index.js silently loads lib/perf.js inside a try/catch. perf.js immediately collects...
OpenSSF/OSV malware advisory MAL-2026-4298 blocks this version. On require('@gbrlxvii/ts-form-utils'), index.js silently loads lib/perf.js inside a try/catch. perf.js immediately collects...
OpenSSF/OSV malware advisory MAL-2026-4298 blocks this version. On require('@gbrlxvii/ts-form-utils'), index.js silently loads lib/perf.js inside a try/catch. perf.js immediately collects...
OpenSSF/OSV malware advisory MAL-2026-4391 blocks this version. The package's package.json declares a postinstall hook ("postinstall": "node install.js") that runs install.js automaticall...
OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...
OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...
OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...
OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...
OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...
OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...