npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 686
Updated 27 Oct 2026, 06:26 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3357 blocks this version. The package 24712-plv2 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3357 blocks this version. The package 24712-plv2 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3362 blocks this version. The package 24712-pl5006 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3362 blocks this version. The package 24712-pl5006 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3361 blocks this version. The package 24712-pl5004 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3358 blocks this version. The package 24712-pl4712 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3668 blocks this version. Tea.yaml token farming campaign
OpenSSF/OSV malware advisory MAL-2026-5593 blocks this version. On `npm install`, scripts/postinstall.cjs recursively copies the package's payload/ directory into process.env.INIT_CWD (th...
OpenSSF/OSV malware advisory MAL-2026-5592 blocks this version. On `npm install`, scripts/postinstall.cjs writes `.mcp.json` into the installer's working directory (INIT_CWD) wiring Claud...
OpenSSF/OSV malware advisory MAL-2026-5591 blocks this version. On `npm install`, the package's postinstall script unconditionally copies its `payload/` tree into the user's project direc...
OpenSSF/OSV malware advisory MAL-2026-5590 blocks this version. On `npm install`, scripts/postinstall.cjs copies the entire payload/ tree into `process.env.INIT_CWD` (the directory the de...
OpenSSF/OSV malware advisory MAL-2026-5598 blocks this version. On `npm install`, scripts/postinstall.cjs copies the package's payload/ tree into the installer's project root (process.env...
OpenSSF/OSV malware advisory MAL-2026-5597 blocks this version. On `npm install`, the package's postinstall script writes `.mcp.json`, `CLAUDE.md`, and a `.claude/commands/0x2ai-boot.md`...
OpenSSF/OSV malware advisory MAL-2026-5589 blocks this version. On `npm install`, scripts/postinstall.cjs recursively copies the bundled payload/ directory into INIT_CWD (the developer's...
OpenSSF/OSV malware advisory MAL-2026-5596 blocks this version. On `npm install`, scripts/postinstall.cjs copies the package's payload/ tree into INIT_CWD (the consumer's project root) us...
OpenSSF/OSV malware advisory MAL-2026-5595 blocks this version. On `npm install`, scripts/postinstall.cjs writes a `.mcp.json` into the installer's working directory that registers a stdi...
OpenSSF/OSV malware advisory MAL-2026-5588 blocks this version. On `npm install`, scripts/postinstall.cjs runs `fs.cpSync(payload, process.env.INIT_CWD, { recursive: true })`, copying.mcp...
OpenSSF/OSV malware advisory MAL-2026-5587 blocks this version. On `npm install`, scripts/postinstall.cjs runs `fs.cpSync(payload, cwd, { recursive: true })` with cwd=`process.env.INIT_CW...
OpenSSF/OSV malware advisory MAL-2026-5587 blocks this version. On `npm install`, scripts/postinstall.cjs runs `fs.cpSync(payload, cwd, { recursive: true })` with cwd=`process.env.INIT_CW...
OpenSSF/OSV malware advisory MAL-2026-5587 blocks this version. On `npm install`, scripts/postinstall.cjs runs `fs.cpSync(payload, cwd, { recursive: true })` with cwd=`process.env.INIT_CW...
OpenSSF/OSV malware advisory MAL-2026-5594 blocks this version. On npm install, scripts/postinstall.cjs copies the package's payload/ tree into the installer's project root (process.env.I...
OpenSSF/OSV malware advisory MAL-2026-5602 blocks this version. On `npm install`, scripts/postinstall.cjs copies the entire payload/ tree into process.env.INIT_CWD (the directory the deve...
OpenSSF/OSV malware advisory MAL-2026-5602 blocks this version. On `npm install`, scripts/postinstall.cjs copies the entire payload/ tree into process.env.INIT_CWD (the directory the deve...
OpenSSF/OSV malware advisory MAL-2026-5601 blocks this version. Running `npx 0x2ai-multi-q` (the package's documented invocation) spawns `claude --dangerously-skip-permissions` and writes...
OpenSSF/OSV malware advisory MAL-2026-5600 blocks this version. When the documented invocation `npx 0x2ai-multi-mq` is run, bin/start.cjs copies `chatroom-mcp-lite-patched.cjs` and `chatr...