npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 694
Updated 27 Oct 2026, 11:01 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4686 blocks this version. tempo-layout@99.0.2 ships a preinstall hook (poc.js) that unconditionally collects host identity (os.hostname, whoami, id),...
OpenSSF/OSV malware advisory MAL-2026-4686 blocks this version. tempo-layout@99.0.2 ships a preinstall hook (poc.js) that unconditionally collects host identity (os.hostname, whoami, id),...
OpenSSF/OSV malware advisory MAL-2026-4686 blocks this version. tempo-layout@99.0.2 ships a preinstall hook (poc.js) that unconditionally collects host identity (os.hostname, whoami, id),...
OpenSSF/OSV malware advisory MAL-2026-5620 blocks this version. OSV/OpenSSF confirms telebot-server@1.0.1 as malicious package MAL-2026-5620. Malicious code in telebot-server (npm)
OpenSSF/OSV malware advisory MAL-2026-4156 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4156 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4155 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4155 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4692 blocks this version. On install, postinstall.js performs an HTTPS request to void-relay.com carrying process.env contents along with host identi...
OpenSSF/OSV malware advisory MAL-2026-4692 blocks this version. On install, postinstall.js performs an HTTPS request to void-relay.com carrying process.env contents along with host identi...
OpenSSF/OSV malware advisory MAL-2026-6357 blocks this version. Although the package presents itself as a 'theme color picker', package.json identifies the publisher as analysis-chart.io...
OpenSSF/OSV malware advisory MAL-2026-6357 blocks this version. Although the package presents itself as a 'theme color picker', package.json identifies the publisher as analysis-chart.io...
OpenSSF/OSV malware advisory MAL-2026-6357 blocks this version. Although the package presents itself as a 'theme color picker', package.json identifies the publisher as analysis-chart.io...
OpenSSF/OSV malware advisory MAL-2026-5637 blocks this version. OSV/OpenSSF confirms tailwindcss-animotion@1.0.1 as malicious package MAL-2026-5637. Malicious code in tailwindcss-animotio...
OpenSSF/OSV malware advisory MAL-2026-5632 blocks this version. OSV/OpenSSF confirms tailwindcss-merge@1.0.4 as malicious package MAL-2026-5632. Malicious code in tailwindcss-merge (npm)
OpenSSF/OSV malware advisory MAL-2026-5632 blocks this version. OSV/OpenSSF confirms tailwindcss-merge@1.0.2 as malicious package MAL-2026-5632. Malicious code in tailwindcss-merge (npm)
OpenSSF/OSV malware advisory MAL-2026-5632 blocks this version. OSV/OpenSSF confirms tailwindcss-merge@1.0.1 as malicious package MAL-2026-5632. Malicious code in tailwindcss-merge (npm)
OpenSSF/OSV malware advisory MAL-2026-6471 blocks this version. The package's documented entry point `index.ts` begins with `import './src/bootstrap';`, which causes `src/bootstrap.js` to...
OpenSSF/OSV malware advisory MAL-2026-5854 blocks this version. OSV/OpenSSF confirms tailwind-typography-style@0.5.8 as malicious package MAL-2026-5854. Malicious code in tailwind-typogra...
OpenSSF/OSV malware advisory MAL-2026-4680 blocks this version. The package name impersonates the official @tailwindcss/typography plugin and replicates its README and source verbatim (in...
OpenSSF/OSV malware advisory MAL-2026-4283 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4283 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4819 blocks this version. The CLI in cli.mjs reads its API key from process.env.TOKEN_ME_UK_API_KEY, falling back to process.env.OPENAI_API_KEY and t...
OpenSSF/OSV malware advisory MAL-2026-6179 blocks this version. The npm package `touchid-images` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Native com...
OpenSSF/OSV malware advisory MAL-2026-4693 blocks this version. package.json declares `postinstall: node index.js`. On `npm install`, index.js unconditionally HTTPS-GETs https://meet-fr.c...