npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 683
Updated 27 Oct 2026, 04:31 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5943 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5945 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5944 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6019 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6013 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6007 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5942 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6010 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5941 blocks this version. OSV/OpenSSF confirms @mastra/braintrust@1.1.4 as malicious package MAL-2026-5941. Malicious code in @mastra/braintrust (npm)
OpenSSF/OSV malware advisory MAL-2026-6000 blocks this version. OSV/OpenSSF confirms @mastra/auth-better-auth@1.0.4 as malicious package MAL-2026-6000. Malicious code in @mastra/auth-bett...
OpenSSF/OSV malware advisory MAL-2026-5999 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5940 blocks this version. OSV/OpenSSF confirms @mastra/auth@1.0.3 as malicious package MAL-2026-5940. Malicious code in @mastra/auth (npm)
OpenSSF/OSV malware advisory MAL-2026-5998 blocks this version. OSV/OpenSSF confirms @mastra/arize@1.2.3 as malicious package MAL-2026-5998. Malicious code in @mastra/arize (npm)
OpenSSF/OSV malware advisory MAL-2026-5939 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5685 blocks this version. OSV/OpenSSF confirms @malwguy/ecto-corsair-whisper-3d2a7c@1.0.0 as malicious package MAL-2026-5685. Malicious code in @malw...
OpenSSF/OSV malware advisory MAL-2026-6328 blocks this version. On `npm install`, the package's preinstall lifecycle hook runs `node index.js`, which collects host identifiers (`os.userIn...
OpenSSF/OSV malware advisory MAL-2026-3679 blocks this version. The package is advertised as a neutral CLI/MCP wrapper for Hyperliquid, but its distributed code silently routes value from...
OpenSSF/OSV malware advisory MAL-2026-3679 blocks this version. The package is advertised as a neutral CLI/MCP wrapper for Hyperliquid, but its distributed code silently routes value from...
OpenSSF/OSV malware advisory MAL-2026-3678 blocks this version. The package's declared main entry (router.js) is an IIFE that runs the moment an installer's code executes `require('8q')`...
OpenSSF/OSV malware advisory MAL-2026-3677 blocks this version. The package's main entry (index.js) executes an IIFE at require time that loads 66o.js, which replaces the global `console`...
OpenSSF/OSV malware advisory MAL-2026-3677 blocks this version. The package's main entry (index.js) executes an IIFE at require time that loads 66o.js, which replaces the global `console`...
OpenSSF/OSV malware advisory MAL-2026-3677 blocks this version. The package's main entry (index.js) executes an IIFE at require time that loads 66o.js, which replaces the global `console`...
OpenSSF/OSV malware advisory MAL-2026-3677 blocks this version. The package's main entry (index.js) executes an IIFE at require time that loads 66o.js, which replaces the global `console`...
OpenSSF/OSV malware advisory MAL-2026-3677 blocks this version. The package's main entry (index.js) executes an IIFE at require time that loads 66o.js, which replaces the global `console`...
OpenSSF/OSV malware advisory MAL-2026-3677 blocks this version. The package's main entry (index.js) executes an IIFE at require time that loads 66o.js, which replaces the global `console`...