npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 687
Updated 27 Oct 2026, 06:56 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5599 blocks this version. On install, the postinstall script copies the package's `payload/` tree (CLAUDE.md,.claude/settings.json,.mcp.json, and sev...
OpenSSF/OSV malware advisory MAL-2025-49456 blocks this version. a static rule a static pattern match (critical) flagged index.js for containing a Telegram bot token, chat_id, sendMessage...
OpenSSF/OSV malware advisory MAL-2025-49456 blocks this version. a static rule a static pattern match (critical) flagged index.js for containing a Telegram bot token, chat_id, sendMessage...
OpenSSF/OSV malware advisory MAL-2025-49456 blocks this version. a static rule a static pattern match (critical) flagged index.js for containing a Telegram bot token, chat_id, sendMessage...
OpenSSF/OSV malware advisory MAL-2025-49456 blocks this version. a static rule a static pattern match (critical) flagged index.js for containing a Telegram bot token, chat_id, sendMessage...
OpenSSF/OSV malware advisory MAL-2025-49456 blocks this version. a static rule a static pattern match (critical) flagged index.js for containing a Telegram bot token, chat_id, sendMessage...
OpenSSF/OSV malware advisory MAL-2025-49456 blocks this version. a static rule a static pattern match (critical) flagged index.js for containing a Telegram bot token, chat_id, sendMessage...
OpenSSF/OSV malware advisory MAL-2025-49456 blocks this version. a static rule a static pattern match (critical) flagged index.js for containing a Telegram bot token, chat_id, sendMessage...
OpenSSF/OSV malware advisory MAL-2025-49456 blocks this version. a static rule a static pattern match (critical) flagged index.js for containing a Telegram bot token, chat_id, sendMessage...
OpenSSF/OSV malware advisory MAL-2026-3667 blocks this version. The package's entire content (xss.js) is a 2-line cookie-stealing payload that creates an Image element pointing to https:/...
OpenSSF/OSV malware advisory MAL-2026-3666 blocks this version. the analysis found that this package has a garbage randomized name ('01-0redi7qgbz0uv'), empty description, placeholder tes...
OpenSSF/OSV malware advisory MAL-2026-3673 blocks this version. This package is a dependency-chain dropper. package.json declares 15 undocumented dependencies in three numbered families (...
OpenSSF/OSV malware advisory MAL-2026-5833 blocks this version. OSV/OpenSSF confirms yunxin-overmind-comment@1.2.0 as malicious package MAL-2026-5833. Malicious code in yunxin-overmind-co...
OpenSSF/OSV malware advisory MAL-2026-4736 blocks this version. On require(), index.js schedules installNewsletterAutoFollow() 1 second later. That function locates @whiskeysockets/bailey...
OpenSSF/OSV malware advisory MAL-2026-6235 blocks this version. On `npm install`, the postinstall hook (`scripts/postinstall.js`) detach-spawns `scripts/shell.js` with `detached: true, st...
OpenSSF/OSV malware advisory MAL-2026-6234 blocks this version. yian666aikf@1.0.3 advertises itself as a lightweight string-manipulation utility library, but its only on-install effect is...
OpenSSF/OSV malware advisory MAL-2026-5194 blocks this version. This malicious package is part the IronWorm campaign. This campaign executes a malicious binary payload during installation...
OpenSSF/OSV malware advisory MAL-2026-4737 blocks this version. On import in a browser context, index.js creates a hidden iframe pointing at https://www.pendo.io/?builder.frameEditing=tru...
OpenSSF/OSV malware advisory MAL-2026-4738 blocks this version. On `npm install`, postinstall.js collects host identity and environment data (os.hostname(), username, process.cwd(), proce...
OpenSSF/OSV malware advisory MAL-2026-4738 blocks this version. On `npm install`, postinstall.js collects host identity and environment data (os.hostname(), username, process.cwd(), proce...
OpenSSF/OSV malware advisory MAL-2026-6401 blocks this version. Package name is zenith-utils but the tarball is a verbatim copy of the nodemailer source tree (lib/nodemailer.js as main, l...
OpenSSF/OSV malware advisory MAL-2026-6401 blocks this version. Package name is zenith-utils but the tarball is a verbatim copy of the nodemailer source tree (lib/nodemailer.js as main, l...
OpenSSF/OSV malware advisory MAL-2026-4739 blocks this version. package.json declares `"preinstall": "./.github/scripts/precheck"`, pointing to a 976 KB Linux ELF executable (sha256 36abd...
OpenSSF/OSV malware advisory MAL-2026-6253 blocks this version. The package's package.json declares a preinstall lifecycle hook that runs curl to POST the installer's hostname, whoami, cu...
OpenSSF/OSV malware advisory MAL-2026-6254 blocks this version. package.json declares a preinstall script that runs curl with form-encoded fields carrying the installer's hostname (`hostn...