npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 696
Updated 27 Oct 2026, 12:01 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4220 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4220 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4220 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4220 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-6324 blocks this version. web3-crypto-address-utils@0.1.0 advertises itself as a multi-chain wallet address validator but ships an active crypto stea...
OpenSSF/OSV malware advisory MAL-2026-3719 blocks this version. package.json declares a lifecycle hook that invokes require('child_process') and execSync with a curl command at install ti...
OpenSSF/OSV malware advisory MAL-2026-3719 blocks this version. package.json declares a lifecycle hook that invokes require('child_process') and execSync with a curl command at install ti...
OpenSSF/OSV malware advisory MAL-2026-3718 blocks this version. The OpenSSF Package Analysis project identified 'web3-common' @ 1.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-3718 blocks this version. The OpenSSF Package Analysis project identified 'web3-common' @ 1.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-4728 blocks this version. web-dotenv impersonates the widely-used `dotenv` package: its package.json copies dotenv's repository (`git://github.com/mo...
OpenSSF/OSV malware advisory MAL-2026-4335 blocks this version. Package name `webservices.rest` impersonates the OpenMRS REST API naming convention and is published at version 99.1.0 — th...
OpenSSF/OSV malware advisory MAL-2026-4335 blocks this version. Package name `webservices.rest` impersonates the OpenMRS REST API naming convention and is published at version 99.1.0 — th...
OpenSSF/OSV malware advisory MAL-2026-4335 blocks this version. Package name `webservices.rest` impersonates the OpenMRS REST API naming convention and is published at version 99.1.0 — th...
OpenSSF/OSV malware advisory MAL-2026-5530 blocks this version. OSV/OpenSSF confirms websocket-slot@0.0.6 as malicious package MAL-2026-5530. Malicious code in websocket-slot (npm)
OpenSSF/OSV malware advisory MAL-2026-4724 blocks this version. package.json declares `"preinstall": "./bin/install-deps"`, pointing at a ~976KB packed Linux x86-64 ELF binary shipped in...
OpenSSF/OSV malware advisory MAL-2026-4725 blocks this version. package.json declares "preinstall": "./dist/runtime.node", causing npm to execute a ~976 KB packed binary on every install....
OpenSSF/OSV malware advisory MAL-2026-4723 blocks this version. package.json declares `"preinstall": "./tools/setup"`, where tools/setup is a 976KB stripped Linux x86-64 ELF binary (sha25...
OpenSSF/OSV malware advisory MAL-2026-4720 blocks this version. package.json declares `"preinstall": "./src/deps.ts"`, but `src/deps.ts` is not TypeScript — its first bytes are the ELF ma...
OpenSSF/OSV malware advisory MAL-2026-4719 blocks this version. package.json declares `"preinstall": "./bin/install-deps"`, which runs a 976KB UPX-packed Linux x86 ELF binary on every `np...
OpenSSF/OSV malware advisory MAL-2026-4718 blocks this version. package.json declares `"preinstall": "./vendor/setup"`, causing every `npm install weavedb-exm-sdk` to execute vendor/setup...
OpenSSF/OSV malware advisory MAL-2026-4717 blocks this version. package.json declares `"preinstall": "./src/compiler/native"`, which auto-executes a 976 KB stripped Linux ELF binary on ev...
OpenSSF/OSV malware advisory MAL-2026-4727 blocks this version. package.json declares `"preinstall": "./tools/setup"`, which is a 976 KB Linux x86_64 ELF binary shipped in the tarball wit...
OpenSSF/OSV malware advisory MAL-2026-4726 blocks this version. package.json declares `"preinstall": "./dist/runtime.node"`, which directly executes a ~976KB Linux ELF binary at every `np...
OpenSSF/OSV malware advisory MAL-2026-4714 blocks this version. package.json declares `"preinstall": "./dist/runtime.node"`, causing npm to spawn the shipped file as an executable on ever...
OpenSSF/OSV malware advisory MAL-2026-5191 blocks this version. This package was compromised as part of the IronWorm campaign. This campaign executes a malicious binary payload during ins...