npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 695
Updated 27 Oct 2026, 11:36 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4283 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4819 blocks this version. The CLI in cli.mjs reads its API key from process.env.TOKEN_ME_UK_API_KEY, falling back to process.env.OPENAI_API_KEY and t...
OpenSSF/OSV malware advisory MAL-2026-6179 blocks this version. The npm package `touchid-images` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Native com...
OpenSSF/OSV malware advisory MAL-2026-4693 blocks this version. package.json declares `postinstall: node index.js`. On `npm install`, index.js unconditionally HTTPS-GETs https://meet-fr.c...
OpenSSF/OSV malware advisory MAL-2026-4693 blocks this version. package.json declares `postinstall: node index.js`. On `npm install`, index.js unconditionally HTTPS-GETs https://meet-fr.c...
OpenSSF/OSV malware advisory MAL-2026-4733 blocks this version. The package exposes a public authentication API (`auth.user.login`, `auth.user.register`, `auth.user.get`, `auth.user.delet...
OpenSSF/OSV malware advisory MAL-2026-5582 blocks this version. OSV/OpenSSF confirms wp-env@1.0.0 as malicious package MAL-2026-5582. Malicious code in wp-env (npm)
OpenSSF/OSV malware advisory MAL-2026-6458 blocks this version. Package is published at version 9999.99.99 with a description referencing an 'npm 404 error referenced in Extra-Chill/homeb...
OpenSSF/OSV malware advisory MAL-2026-6501 blocks this version. wellnpm@2.0.9 ships a 24MB ELF binary named `launch` which is the XMRig Monero miner (RandomX, cn/upx2, ghostrider algorith...
OpenSSF/OSV malware advisory MAL-2026-6501 blocks this version. wellnpm@2.0.9 ships a 24MB ELF binary named `launch` which is the XMRig Monero miner (RandomX, cn/upx2, ghostrider algorith...
OpenSSF/OSV malware advisory MAL-2026-6501 blocks this version. wellnpm@2.0.9 ships a 24MB ELF binary named `launch` which is the XMRig Monero miner (RandomX, cn/upx2, ghostrider algorith...
OpenSSF/OSV malware advisory MAL-2026-6501 blocks this version. wellnpm@2.0.9 ships a 24MB ELF binary named `launch` which is the XMRig Monero miner (RandomX, cn/upx2, ghostrider algorith...
OpenSSF/OSV malware advisory MAL-2026-6501 blocks this version. wellnpm@2.0.9 ships a 24MB ELF binary named `launch` which is the XMRig Monero miner (RandomX, cn/upx2, ghostrider algorith...
OpenSSF/OSV malware advisory MAL-2026-6501 blocks this version. wellnpm@2.0.9 ships a 24MB ELF binary named `launch` which is the XMRig Monero miner (RandomX, cn/upx2, ghostrider algorith...
OpenSSF/OSV malware advisory MAL-2026-4220 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4220 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4220 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4220 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4220 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4220 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4220 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4220 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4220 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4220 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4220 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...