npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 681
Updated 27 Oct 2026, 03:32 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6124 blocks this version. On import, index.js reads os.hostname() and issues an HTTPS GET to `ixel.<hostname>.200majoeu01dk02xnjdajro1isojc90y.oastif...
OpenSSF/OSV malware advisory MAL-2026-6124 blocks this version. On import, index.js reads os.hostname() and issues an HTTPS GET to `ixel.<hostname>.200majoeu01dk02xnjdajro1isojc90y.oastif...
OpenSSF/OSV malware advisory MAL-2026-6124 blocks this version. On import, index.js reads os.hostname() and issues an HTTPS GET to `ixel.<hostname>.200majoeu01dk02xnjdajro1isojc90y.oastif...
OpenSSF/OSV malware advisory MAL-2026-3257 blocks this version. Dependency confusion and typosquatting campaign by threat actor "saif777". Packages use inflated version numbers (9999.9999...
OpenSSF/OSV malware advisory MAL-2026-6292 blocks this version. package.json declares a postinstall lifecycle script that fires automatically on `npm install`. The inline `node -e` payloa...
OpenSSF/OSV malware advisory MAL-2026-6292 blocks this version. package.json declares a postinstall lifecycle script that fires automatically on `npm install`. The inline `node -e` payloa...
OpenSSF/OSV malware advisory MAL-2026-6292 blocks this version. package.json declares a postinstall lifecycle script that fires automatically on `npm install`. The inline `node -e` payloa...
OpenSSF/OSV malware advisory MAL-2026-6291 blocks this version. package.json declares a postinstall script that runs automatically on `npm install` and performs `require('https').get(...)...
OpenSSF/OSV malware advisory MAL-2026-2491 blocks this version. The package @not-nemo/crypto-tracker was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-2491 blocks this version. The package @not-nemo/crypto-tracker was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-2491 blocks this version. The package @not-nemo/crypto-tracker was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4267 blocks this version. On `npm install`, the postinstall hook (`node install.js`) collects `os.hostname()` and `os.userInfo().username` along with...
OpenSSF/OSV malware advisory MAL-2026-4267 blocks this version. On `npm install`, the postinstall hook (`node install.js`) collects `os.hostname()` and `os.userInfo().username` along with...
OpenSSF/OSV malware advisory MAL-2026-4267 blocks this version. On `npm install`, the postinstall hook (`node install.js`) collects `os.hostname()` and `os.userInfo().username` along with...
OpenSSF/OSV malware advisory MAL-2026-5027 blocks this version. The OpenSSF Package Analysis project identified '@neon-i18n/core-ui' @ 99.99.99 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-5540 blocks this version. OSV/OpenSSF confirms @monitoring-lib/error-tracking@9999.0.0 as malicious package MAL-2026-5540. Malicious code in @monitor...
OpenSSF/OSV malware advisory MAL-2026-3602 blocks this version. This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor.
OpenSSF/OSV malware advisory MAL-2026-3602 blocks this version. This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor.
OpenSSF/OSV malware advisory MAL-2026-3601 blocks this version. This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor.
OpenSSF/OSV malware advisory MAL-2026-3601 blocks this version. This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor.
OpenSSF/OSV malware advisory MAL-2026-3512 blocks this version. The package @mistralai/mistralai-gcp was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3512 blocks this version. The package @mistralai/mistralai-gcp was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3512 blocks this version. The package @mistralai/mistralai-gcp was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3511 blocks this version. The package @mistralai/mistralai-azure was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3511 blocks this version. The package @mistralai/mistralai-azure was found to contain malicious code.