npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 690
Updated 27 Oct 2026, 08:45 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4344 blocks this version. On `npm install`, postinstall.js executes `whoami` and `id`, collects host identity (hostname, platform, cwd) and CI metada...
OpenSSF/OSV malware advisory MAL-2026-5832 blocks this version. OSV/OpenSSF confirms vend-utilities@14.12.11 as malicious package MAL-2026-5832. Malicious code in vend-utilities (npm)
OpenSSF/OSV malware advisory MAL-2026-6487 blocks this version. Package masquerades as 'Performance fixes for Minecraft Velocity proxy' authored by 'Velocity Team' — Velocity is a Java pr...
OpenSSF/OSV malware advisory MAL-2026-6487 blocks this version. Package masquerades as 'Performance fixes for Minecraft Velocity proxy' authored by 'Velocity Team' — Velocity is a Java pr...
OpenSSF/OSV malware advisory MAL-2026-6487 blocks this version. Package masquerades as 'Performance fixes for Minecraft Velocity proxy' authored by 'Velocity Team' — Velocity is a Java pr...
OpenSSF/OSV malware advisory MAL-2026-6487 blocks this version. Package masquerades as 'Performance fixes for Minecraft Velocity proxy' authored by 'Velocity Team' — Velocity is a Java pr...
OpenSSF/OSV malware advisory MAL-2026-6487 blocks this version. Package masquerades as 'Performance fixes for Minecraft Velocity proxy' authored by 'Velocity Team' — Velocity is a Java pr...
OpenSSF/OSV malware advisory MAL-2026-4704 blocks this version. On `npm install`, the postinstall hook (`node install.js`) downloads a platform-specific binary archive from a hardcoded `h...
OpenSSF/OSV malware advisory MAL-2026-4703 blocks this version. On `npm install`, the package's postinstall hook (`install.js`, registered via `package.json` line 10 `"postinstall": "node...
OpenSSF/OSV malware advisory MAL-2026-4703 blocks this version. On `npm install`, the package's postinstall hook (`install.js`, registered via `package.json` line 10 `"postinstall": "node...
OpenSSF/OSV malware advisory MAL-2026-4703 blocks this version. On `npm install`, the package's postinstall hook (`install.js`, registered via `package.json` line 10 `"postinstall": "node...
OpenSSF/OSV malware advisory MAL-2026-6181 blocks this version. The npm package `virtualization-compression-collapse` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a decep...
OpenSSF/OSV malware advisory MAL-2026-6181 blocks this version. The npm package `virtualization-compression-collapse` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a decep...
OpenSSF/OSV malware advisory MAL-2026-5862 blocks this version. OSV/OpenSSF confirms vitest-pro@7.0.6 as malicious package MAL-2026-5862. Malicious code in vitest-pro (npm)
OpenSSF/OSV malware advisory MAL-2026-5862 blocks this version. OSV/OpenSSF confirms vitest-pro@7.0.5 as malicious package MAL-2026-5862. Malicious code in vitest-pro (npm)
OpenSSF/OSV malware advisory MAL-2026-6267 blocks this version. Package name `vitest-cli` impersonates the official Vitest project while declaring empty `author`, `homepage`, `repository`...
OpenSSF/OSV malware advisory MAL-2026-6267 blocks this version. Package name `vitest-cli` impersonates the official Vitest project while declaring empty `author`, `homepage`, `repository`...
OpenSSF/OSV malware advisory MAL-2026-6267 blocks this version. Package name `vitest-cli` impersonates the official Vitest project while declaring empty `author`, `homepage`, `repository`...
OpenSSF/OSV malware advisory MAL-2026-6267 blocks this version. Package name `vitest-cli` impersonates the official Vitest project while declaring empty `author`, `homepage`, `repository`...
OpenSSF/OSV malware advisory MAL-2026-6267 blocks this version. Package name `vitest-cli` impersonates the official Vitest project while declaring empty `author`, `homepage`, `repository`...
OpenSSF/OSV malware advisory MAL-2026-5708 blocks this version. OSV/OpenSSF confirms vite-svgr@1.1.3 as malicious package MAL-2026-5708. Malicious code in vite-svgr (npm)
OpenSSF/OSV malware advisory MAL-2026-5708 blocks this version. OSV/OpenSSF confirms vite-svgr@1.1.2 as malicious package MAL-2026-5708. Malicious code in vite-svgr (npm)
OpenSSF/OSV malware advisory MAL-2026-4706 blocks this version. The package is published as a Vite CSS plugin but exposes no Vite plugin API. Its documented `applyGlobalStyles({palette, a...
OpenSSF/OSV malware advisory MAL-2026-4705 blocks this version. The package presents itself as a vite/tsconfig path helper and clones the public API of tsconfig-paths (createMatchPath, ma...
OpenSSF/OSV malware advisory MAL-2026-5728 blocks this version. OSV/OpenSSF confirms vite-config-react@1.3.1 as malicious package MAL-2026-5728. Malicious code in vite-config-react (npm)