npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 682
Updated 27 Oct 2026, 04:03 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3511 blocks this version. The package @mistralai/mistralai-azure was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3432 blocks this version. The package @mistralai/mistralai was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3432 blocks this version. The package @mistralai/mistralai was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3432 blocks this version. The package @mistralai/mistralai was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6509 blocks this version. Package is published as @merceas/anchor but its README, homepage (https://github.com/coral-xyz/anchor#readme), repository,...
OpenSSF/OSV malware advisory MAL-2026-6509 blocks this version. Package is published as @merceas/anchor but its README, homepage (https://github.com/coral-xyz/anchor#readme), repository,...
OpenSSF/OSV malware advisory MAL-2026-6510 blocks this version. Package is published under the @merceas scope as `cross-fetch` and reuses the upstream cross-fetch README, homepage (github...
OpenSSF/OSV malware advisory MAL-2026-3510 blocks this version. The package @mesadev/rest was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3600 blocks this version. This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor.
OpenSSF/OSV malware advisory MAL-2026-3599 blocks this version. This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor.
OpenSSF/OSV malware advisory MAL-2026-4171 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5960 blocks this version. OSV/OpenSSF confirms @mastra/posthog@1.0.29 as malicious package MAL-2026-5960. Malicious code in @mastra/posthog (npm)
OpenSSF/OSV malware advisory MAL-2026-5956 blocks this version. OSV/OpenSSF confirms @mastra/mcp-docs-server@1.1.47 as malicious package MAL-2026-5956. Malicious code in @mastra/mcp-docs-...
OpenSSF/OSV malware advisory MAL-2026-5955 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5952 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5953 blocks this version. OSV/OpenSSF confirms @mastra/langsmith@1.2.4 as malicious package MAL-2026-5953. Malicious code in @mastra/langsmith (npm)
OpenSSF/OSV malware advisory MAL-2026-6072 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5954 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5951 blocks this version. OSV/OpenSSF confirms @mastra/inngest@1.5.2 as malicious package MAL-2026-5951. Malicious code in @mastra/inngest (npm)
OpenSSF/OSV malware advisory MAL-2026-5950 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5948 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5949 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5946 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5947 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6015 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...