npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 698
Updated 27 Oct 2026, 13:12 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4250 blocks this version. Package presents itself as a 'Community Security Alliance' MCP server for verifying cryptocurrency wallet backups, but perf...
OpenSSF/OSV malware advisory MAL-2026-4250 blocks this version. Package presents itself as a 'Community Security Alliance' MCP server for verifying cryptocurrency wallet backups, but perf...
OpenSSF/OSV malware advisory MAL-2026-4250 blocks this version. Package presents itself as a 'Community Security Alliance' MCP server for verifying cryptocurrency wallet backups, but perf...
OpenSSF/OSV malware advisory MAL-2026-4250 blocks this version. Package presents itself as a 'Community Security Alliance' MCP server for verifying cryptocurrency wallet backups, but perf...
OpenSSF/OSV malware advisory MAL-2026-4250 blocks this version. Package presents itself as a 'Community Security Alliance' MCP server for verifying cryptocurrency wallet backups, but perf...
OpenSSF/OSV malware advisory MAL-2026-4250 blocks this version. Package presents itself as a 'Community Security Alliance' MCP server for verifying cryptocurrency wallet backups, but perf...
OpenSSF/OSV malware advisory MAL-2026-4250 blocks this version. Package presents itself as a 'Community Security Alliance' MCP server for verifying cryptocurrency wallet backups, but perf...
OpenSSF/OSV malware advisory MAL-2026-4709 blocks this version. dist/agent.js contains a hardcoded Telegram Bot API endpoint (https://api.telegram.org) reached via fetch() with a POST bod...
OpenSSF/OSV malware advisory MAL-2026-6347 blocks this version. Package `wagmi_util` impersonates the popular `wagmi` package: it copies wagmi's tagline ("React Hooks for Ethereum"), re-e...
OpenSSF/OSV malware advisory MAL-2026-4158 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4158 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4284 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4284 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-5715 blocks this version. OSV/OpenSSF confirms workflow-postgres-setup@1.0.0 as malicious package MAL-2026-5715. Malicious code in workflow-postgres-...
OpenSSF/OSV malware advisory MAL-2026-3591 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3591 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3591 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3591 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3591 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-4731 blocks this version. wml-core@99.0.1 is a dependency-confusion package targeting an internal `wml-*` namespace, published with an inflated versi...
OpenSSF/OSV malware advisory MAL-2026-4730 blocks this version. wml-components@99.0.1 declares `preinstall: node poc.js` in package.json, so `npm install` automatically runs poc.js with n...
OpenSSF/OSV malware advisory MAL-2026-3128 blocks this version. The package wm-plugin-teach-me-widget was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4826 blocks this version. wm-mapper@99.9.1 is an empty stub (index.js is 35 bytes exporting `{}`, no description, no author) published at an artifici...
OpenSSF/OSV malware advisory MAL-2026-4654 blocks this version. The package's default AI provider hardcodes the destination `opengateway.gitlawb.com/v1/chat/completions` with header `api-...
OpenSSF/OSV malware advisory MAL-2026-6144 blocks this version. On require(), index.js (lines 70-77) fetches JSON from https://jsonkeeper.com/b/CI3HT, extracts the `.cookie` field from th...