npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 685
Updated 27 Oct 2026, 05:50 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3676 blocks this version. The main entrypoint index.js runs an IIFE at require time that monkey-patches the global console.warn and console.error met...
OpenSSF/OSV malware advisory MAL-2026-3676 blocks this version. The main entrypoint index.js runs an IIFE at require time that monkey-patches the global console.warn and console.error met...
OpenSSF/OSV malware advisory MAL-2026-3676 blocks this version. The main entrypoint index.js runs an IIFE at require time that monkey-patches the global console.warn and console.error met...
OpenSSF/OSV malware advisory MAL-2026-3675 blocks this version. index.js executes on require as an IIFE that reassigns console.warn/error (and adds console.SL/FB/N) to forward arguments v...
OpenSSF/OSV malware advisory MAL-2026-3674 blocks this version. On `require()`, index.js replaces the global `console` object with a Proxy (index.js:36-73) that intercepts console.error/i...
OpenSSF/OSV malware advisory MAL-2026-3674 blocks this version. On `require()`, index.js replaces the global `console` object with a Proxy (index.js:36-73) that intercepts console.error/i...
OpenSSF/OSV malware advisory MAL-2026-3674 blocks this version. On `require()`, index.js replaces the global `console` object with a Proxy (index.js:36-73) that intercepts console.error/i...
OpenSSF/OSV malware advisory MAL-2026-3674 blocks this version. On `require()`, index.js replaces the global `console` object with a Proxy (index.js:36-73) that intercepts console.error/i...
OpenSSF/OSV malware advisory MAL-2026-3674 blocks this version. On `require()`, index.js replaces the global `console` object with a Proxy (index.js:36-73) that intercepts console.error/i...
OpenSSF/OSV malware advisory MAL-2026-3674 blocks this version. On `require()`, index.js replaces the global `console` object with a Proxy (index.js:36-73) that intercepts console.error/i...
OpenSSF/OSV malware advisory MAL-2026-3671 blocks this version. The package's main entry (index.js) exports a console replacement whose.info() method silently POSTs caller-provided argume...
OpenSSF/OSV malware advisory MAL-2026-4778 blocks this version. On `npm install`, the package's postinstall hook (`node install.js`) fetches a platform-specific executable from `http://15...
OpenSSF/OSV malware advisory MAL-2026-4778 blocks this version. On `npm install`, the package's postinstall hook (`node install.js`) fetches a platform-specific executable from `http://15...
OpenSSF/OSV malware advisory MAL-2026-3672 blocks this version. This package masquerades as a Cloudflare Worker Telegraf middleware (README: 'cfworker-middware-telegraf') but its main mod...
OpenSSF/OSV malware advisory MAL-2026-3670 blocks this version. the analysis identified unambiguous malicious behavior in log.js (the package main): an IIFE executes on require/import tha...
OpenSSF/OSV malware advisory MAL-2026-3670 blocks this version. the analysis identified unambiguous malicious behavior in log.js (the package main): an IIFE executes on require/import tha...
OpenSSF/OSV malware advisory MAL-2026-3670 blocks this version. the analysis identified unambiguous malicious behavior in log.js (the package main): an IIFE executes on require/import tha...
OpenSSF/OSV malware advisory MAL-2026-3670 blocks this version. the analysis identified unambiguous malicious behavior in log.js (the package main): an IIFE executes on require/import tha...
OpenSSF/OSV malware advisory MAL-2026-3670 blocks this version. the analysis identified unambiguous malicious behavior in log.js (the package main): an IIFE executes on require/import tha...
OpenSSF/OSV malware advisory MAL-2026-3670 blocks this version. the analysis identified unambiguous malicious behavior in log.js (the package main): an IIFE executes on require/import tha...
OpenSSF/OSV malware advisory MAL-2026-3669 blocks this version. The main entry g.js constructs an image beacon whose src is a base64-decoded attacker URL (https://w.g32.com/g?k=) concaten...
OpenSSF/OSV malware advisory MAL-2026-5740 blocks this version. OSV/OpenSSF confirms 2fa-exe@1.0.1 as malicious package MAL-2026-5740. Malicious code in 2fa-exe (npm)
OpenSSF/OSV malware advisory MAL-2026-5740 blocks this version. OSV/OpenSSF confirms 2fa-exe@1.0.0 as malicious package MAL-2026-5740. Malicious code in 2fa-exe (npm)
OpenSSF/OSV malware advisory MAL-2026-3357 blocks this version. The package 24712-plv2 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3357 blocks this version. The package 24712-plv2 was found to contain malicious code.