npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 688
Updated 27 Oct 2026, 07:35 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6252 blocks this version. On `npm install`, the package's preinstall lifecycle script in package.json runs curl to POST the installer's hostname, cur...
OpenSSF/OSV malware advisory MAL-2026-6269 blocks this version. Package is a dependency-confusion lure targeting Zomato's internal namespace. package.json declares a preinstall hook that...
OpenSSF/OSV malware advisory MAL-2026-6268 blocks this version. package.json declares a preinstall lifecycle hook that runs curl to POST the installer's hostname, whoami output, current w...
OpenSSF/OSV malware advisory MAL-2026-6251 blocks this version. Dependency-confusion package targeting an internal Zomato namespace. The package ships only a stub index.js (`module.export...
OpenSSF/OSV malware advisory MAL-2026-6270 blocks this version. On `npm install`, the package's preinstall lifecycle script runs `curl` against `http://d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.o...
OpenSSF/OSV malware advisory MAL-2026-4735 blocks this version. xy-ai-chat ships a Lit web component (<ai-chat-element>) whose bundled main entry hardcodes two plain-HTTP endpoints on a b...
OpenSSF/OSV malware advisory MAL-2026-4735 blocks this version. xy-ai-chat ships a Lit web component (<ai-chat-element>) whose bundled main entry hardcodes two plain-HTTP endpoints on a b...
OpenSSF/OSV malware advisory MAL-2026-5746 blocks this version. OSV/OpenSSF confirms xy-shared@999.0.0 as malicious package MAL-2026-5746. Malicious code in xy-shared (npm)
OpenSSF/OSV malware advisory MAL-2026-4352 blocks this version. The package ships a `preinstall` hook (`node poc.js || true`) that runs on every `npm install`. poc.js collects host finger...
OpenSSF/OSV malware advisory MAL-2026-4734 blocks this version. On `require('xorma-js')`, a top-level IIFE in dist/index.js synchronously executes `npm uninstall clsx-js && npm install cl...
OpenSSF/OSV malware advisory MAL-2026-5492 blocks this version. OSV/OpenSSF confirms xnder-wrapper-module@1.0.2 as malicious package MAL-2026-5492. Malicious code in xnder-wrapper-module...
OpenSSF/OSV malware advisory MAL-2026-5492 blocks this version. OSV/OpenSSF confirms xnder-wrapper-module@1.0.1 as malicious package MAL-2026-5492. Malicious code in xnder-wrapper-module...
OpenSSF/OSV malware advisory MAL-2026-5492 blocks this version. OSV/OpenSSF confirms xnder-wrapper-module@1.0.0 as malicious package MAL-2026-5492. Malicious code in xnder-wrapper-module...
OpenSSF/OSV malware advisory MAL-2026-4159 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4159 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-6180 blocks this version. The npm package `userinterface-machinelearning` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive R...
OpenSSF/OSV malware advisory MAL-2026-4157 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4157 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-3315 blocks this version. The package update-db was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3315 blocks this version. The package update-db was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3314 blocks this version. The package update-browserslist was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-5288 blocks this version. The OpenSSF Package Analysis project identified 'uisp-connector' @ 99.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-3036 blocks this version. The package uipath-ui-widgets was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-5910 blocks this version. On `npm install`, the preinstall lifecycle script in package.json executes an inline Node one-liner that collects the insta...
OpenSSF/OSV malware advisory MAL-2026-5910 blocks this version. On `npm install`, the preinstall lifecycle script in package.json executes an inline Node one-liner that collects the insta...