npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 689
Updated 27 Oct 2026, 08:11 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5910 blocks this version. On `npm install`, the preinstall lifecycle script in package.json executes an inline Node one-liner that collects the insta...
OpenSSF/OSV malware advisory MAL-2026-5910 blocks this version. On `npm install`, the preinstall lifecycle script in package.json executes an inline Node one-liner that collects the insta...
OpenSSF/OSV malware advisory MAL-2026-5910 blocks this version. On `npm install`, the preinstall lifecycle script in package.json executes an inline Node one-liner that collects the insta...
OpenSSF/OSV malware advisory MAL-2026-5406 blocks this version. OSV/OpenSSF confirms ui-weave@1.0.3 as malicious package MAL-2026-5406. Malicious code in ui-weave (npm)
OpenSSF/OSV malware advisory MAL-2026-5287 blocks this version. The OpenSSF Package Analysis project identified 'uhd-setup' @ 99.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-6486 blocks this version. On `npm install`, the package's postinstall lifecycle script (scripts/postinstall.js) reads the installer's AWS credentials...
OpenSSF/OSV malware advisory MAL-2026-6486 blocks this version. On `npm install`, the package's postinstall lifecycle script (scripts/postinstall.js) reads the installer's AWS credentials...
OpenSSF/OSV malware advisory MAL-2026-6486 blocks this version. On `npm install`, the package's postinstall lifecycle script (scripts/postinstall.js) reads the installer's AWS credentials...
OpenSSF/OSV malware advisory MAL-2026-6486 blocks this version. On `npm install`, the package's postinstall lifecycle script (scripts/postinstall.js) reads the installer's AWS credentials...
OpenSSF/OSV malware advisory MAL-2026-6486 blocks this version. On `npm install`, the package's postinstall lifecycle script (scripts/postinstall.js) reads the installer's AWS credentials...
OpenSSF/OSV malware advisory MAL-2026-6486 blocks this version. On `npm install`, the package's postinstall lifecycle script (scripts/postinstall.js) reads the installer's AWS credentials...
OpenSSF/OSV malware advisory MAL-2026-6486 blocks this version. On `npm install`, the package's postinstall lifecycle script (scripts/postinstall.js) reads the installer's AWS credentials...
OpenSSF/OSV malware advisory MAL-2026-6486 blocks this version. On `npm install`, the package's postinstall lifecycle script (scripts/postinstall.js) reads the installer's AWS credentials...
OpenSSF/OSV malware advisory MAL-2026-4827 blocks this version. unleash-js@99.9.1 is an empty stub package (index.js exports `{}`, 35 bytes; no author, no description) whose sole effect i...
OpenSSF/OSV malware advisory MAL-2026-6441 blocks this version. On require('unifydata'), index.js calls initPlugin() at module top level, performs an HTTPS GET to https://jsonkeeper.com/b...
OpenSSF/OSV malware advisory MAL-2026-5289 blocks this version. The OpenSSF Package Analysis project identified 'unifi-portal' @ 99.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-5831 blocks this version. OSV/OpenSSF confirms unicocheck-ios@9.9.9 as malicious package MAL-2026-5831. Malicious code in unicocheck-ios (npm)
OpenSSF/OSV malware advisory MAL-2026-5829 blocks this version. OSV/OpenSSF confirms unico-android@9.9.9 as malicious package MAL-2026-5829. Malicious code in unico-android (npm)
OpenSSF/OSV malware advisory MAL-2026-5830 blocks this version. OSV/OpenSSF confirms unico-check@9.9.9 as malicious package MAL-2026-5830. Malicious code in unico-check (npm)
OpenSSF/OSV malware advisory MAL-2026-5672 blocks this version. OSV/OpenSSF confirms vqlxjmpr@1.0.4 as malicious package MAL-2026-5672. Malicious code in vqlxjmpr (npm)
OpenSSF/OSV malware advisory MAL-2026-5672 blocks this version. OSV/OpenSSF confirms vqlxjmpr@1.0.3 as malicious package MAL-2026-5672. Malicious code in vqlxjmpr (npm)
OpenSSF/OSV malware advisory MAL-2026-5672 blocks this version. OSV/OpenSSF confirms vqlxjmpr@1.0.2 as malicious package MAL-2026-5672. Malicious code in vqlxjmpr (npm)
OpenSSF/OSV malware advisory MAL-2026-5672 blocks this version. OSV/OpenSSF confirms vqlxjmpr@1.0.1 as malicious package MAL-2026-5672. Malicious code in vqlxjmpr (npm)
OpenSSF/OSV malware advisory MAL-2026-5672 blocks this version. OSV/OpenSSF confirms vqlxjmpr@1.0.0 as malicious package MAL-2026-5672. Malicious code in vqlxjmpr (npm)
OpenSSF/OSV malware advisory MAL-2026-4179 blocks this version. The OpenSSF Package Analysis project identified 'vfat-tools' @ 2.0.0 (npm) as malicious.