npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 680
Updated 27 Oct 2026, 02:57 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...
OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...
OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...
OpenSSF/OSV malware advisory MAL-2026-3434 blocks this version. The package @opensearch-project/opensearch was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3434 blocks this version. The package @opensearch-project/opensearch was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3434 blocks this version. The package @opensearch-project/opensearch was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3434 blocks this version. The package @opensearch-project/opensearch was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3844 blocks this version. The package @openclaw-cn/toutiao-ops was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3842 blocks this version. The package @openclaw-cn/feishu was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3843 blocks this version. The package @openclaw-cn/libsignal was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3841 blocks this version. The package @openclaw-cn/cli was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6123 blocks this version. On `require('@onum-releases/auth')`, index.js reads `os.hostname()` and issues an HTTP GET to `auth.<hostname>.200majoeu01d...
OpenSSF/OSV malware advisory MAL-2026-6123 blocks this version. On `require('@onum-releases/auth')`, index.js reads `os.hostname()` and issues an HTTP GET to `auth.<hostname>.200majoeu01d...
OpenSSF/OSV malware advisory MAL-2026-6123 blocks this version. On `require('@onum-releases/auth')`, index.js reads `os.hostname()` and issues an HTTP GET to `auth.<hostname>.200majoeu01d...
OpenSSF/OSV malware advisory MAL-2026-6122 blocks this version. On require(), index.js reads os.hostname(), embeds it as a subdomain label under a Burp Collaborator (oastify.com) host, an...
OpenSSF/OSV malware advisory MAL-2026-6122 blocks this version. On require(), index.js reads os.hostname(), embeds it as a subdomain label under a Burp Collaborator (oastify.com) host, an...
OpenSSF/OSV malware advisory MAL-2026-6122 blocks this version. On require(), index.js reads os.hostname(), embeds it as a subdomain label under a Burp Collaborator (oastify.com) host, an...
OpenSSF/OSV malware advisory MAL-2026-6127 blocks this version. On require('@onum-releases/utils'), index.js reads os.hostname() and issues an HTTP GET to 'utils.<hostname>.200majoeu01dk0...
OpenSSF/OSV malware advisory MAL-2026-6127 blocks this version. On require('@onum-releases/utils'), index.js reads os.hostname() and issues an HTTP GET to 'utils.<hostname>.200majoeu01dk0...
OpenSSF/OSV malware advisory MAL-2026-6125 blocks this version. On import, index.js reads the installer's machine hostname via os.hostname(), embeds it as a subdomain of a hardcoded *.oas...
OpenSSF/OSV malware advisory MAL-2026-6125 blocks this version. On import, index.js reads the installer's machine hostname via os.hostname(), embeds it as a subdomain of a hardcoded *.oas...
OpenSSF/OSV malware advisory MAL-2026-6125 blocks this version. On import, index.js reads the installer's machine hostname via os.hostname(), embeds it as a subdomain of a hardcoded *.oas...
OpenSSF/OSV malware advisory MAL-2026-6126 blocks this version. On require()/import, index.js reads os.hostname() and issues an HTTP GET to 'shared-components.<hostname>.200majoeu01dk02xn...
OpenSSF/OSV malware advisory MAL-2026-6126 blocks this version. On require()/import, index.js reads os.hostname() and issues an HTTP GET to 'shared-components.<hostname>.200majoeu01dk02xn...
OpenSSF/OSV malware advisory MAL-2026-6126 blocks this version. On require()/import, index.js reads os.hostname() and issues an HTTP GET to 'shared-components.<hostname>.200majoeu01dk02xn...