npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 692
Updated 27 Oct 2026, 09:54 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3505 blocks this version. The package ts-dna was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3505 blocks this version. The package ts-dna was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6321 blocks this version. Package ts-grok ships a verbatim copy of big.js v7.0.1 (same banner, author 'Michael Mclaughlin', repository URL https://gi...
OpenSSF/OSV malware advisory MAL-2026-6315 blocks this version. ts-arithmetic-helper@3.7.2 ships source files that copy the big.js v7.0.1 library verbatim (preserving Michael Mclaughlin's...
OpenSSF/OSV malware advisory MAL-2026-6317 blocks this version. ts-bn-lint@3.1.19 is a credential harvester disguised as a TypeScript/lint utility. index.js defines `decodeStr` which base...
OpenSSF/OSV malware advisory MAL-2026-6317 blocks this version. ts-bn-lint@3.1.19 is a credential harvester disguised as a TypeScript/lint utility. index.js defines `decodeStr` which base...
OpenSSF/OSV malware advisory MAL-2026-6322 blocks this version. Package is published as `ts-predict-helper` but ships a byte-equivalent copy of big.js v7.0.1's source and README (which st...
OpenSSF/OSV malware advisory MAL-2026-6322 blocks this version. Package is published as `ts-predict-helper` but ships a byte-equivalent copy of big.js v7.0.1's source and README (which st...
OpenSSF/OSV malware advisory MAL-2026-6323 blocks this version. The package publishes under the name `ts-sudo` but ships a verbatim copy of the big.js v7.0.1 source (`big.js`, `big.mjs`)...
OpenSSF/OSV malware advisory MAL-2026-6468 blocks this version. ts-opus 0.0.8 ships an unmodified copy of MikeMcl/big.js (README, copyright, and repository URL all reference big.js) but i...
OpenSSF/OSV malware advisory MAL-2026-5633 blocks this version. OSV/OpenSSF confirms typeorm-encrypt@1.0.2 as malicious package MAL-2026-5633. Malicious code in typeorm-encrypt (npm)
OpenSSF/OSV malware advisory MAL-2026-5633 blocks this version. OSV/OpenSSF confirms typeorm-encrypt@1.0.1 as malicious package MAL-2026-5633. Malicious code in typeorm-encrypt (npm)
OpenSSF/OSV malware advisory MAL-2026-6101 blocks this version. The package declares a postinstall hook ("postinstall": "node run.js") that runs run.js automatically on `npm install`. run...
OpenSSF/OSV malware advisory MAL-2026-3776 blocks this version. The package impersonates the legitimate @tailwindcss/typography plugin: README, src/index.js, src/utils.js, and src/styles....
OpenSSF/OSV malware advisory MAL-2026-6297 blocks this version. Package is a dependency-confusion lure: it claims version 9999.99.99 with description 'npm 404 error referenced in Alexande...
OpenSSF/OSV malware advisory MAL-2026-3340 blocks this version. The package trevlo was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3340 blocks this version. The package trevlo was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3340 blocks this version. The package trevlo was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3340 blocks this version. The package trevlo was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3340 blocks this version. The package trevlo was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3340 blocks this version. The package trevlo was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3340 blocks this version. The package trevlo was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3717 blocks this version. The package.json lifecycle script invokes require('child_process').execSync with a curl command at install time. Running cu...
OpenSSF/OSV malware advisory MAL-2026-3717 blocks this version. The package.json lifecycle script invokes require('child_process').execSync with a curl command at install time. Running cu...
OpenSSF/OSV malware advisory MAL-2026-3716 blocks this version. package.json line 7 invokes require('child_process') and execSync('curl...') from an npm lifecycle script. This causes the...