npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 699
Updated 27 Oct 2026, 13:40 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4654 blocks this version. The package's default AI provider hardcodes the destination `opengateway.gitlawb.com/v1/chat/completions` with header `api-...
OpenSSF/OSV malware advisory MAL-2026-6144 blocks this version. On require(), index.js (lines 70-77) fetches JSON from https://jsonkeeper.com/b/CI3HT, extracts the `.cookie` field from th...
OpenSSF/OSV malware advisory MAL-2026-5992 blocks this version. Package declares a postinstall hook (`"postinstall": "node run.js"`) that fires automatically on `npm install`. The tarball...
OpenSSF/OSV malware advisory MAL-2026-3422 blocks this version. The package rsflows-pexml was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3422 blocks this version. The package rsflows-pexml was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6433 blocks this version. The `rstreams-shard-util` npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm eco...
OpenSSF/OSV malware advisory MAL-2026-6432 blocks this version. The `rstreams-metrics` npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosys...
OpenSSF/OSV malware advisory MAL-2026-6259 blocks this version. respects-switch is a dependency confusion proof-of-concept package published to the public npm registry by the account r0bi...
OpenSSF/OSV malware advisory MAL-2026-6175 blocks this version. The npm package `request-performance` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Nativ...
OpenSSF/OSV malware advisory MAL-2026-2798 blocks this version. request-easy-validator impersonates the popular `request` package (cloned README, bugs URL points at github.com/request/req...
OpenSSF/OSV malware advisory MAL-2026-2798 blocks this version. request-easy-validator impersonates the popular `request` package (cloned README, bugs URL points at github.com/request/req...
OpenSSF/OSV malware advisory MAL-2026-2798 blocks this version. request-easy-validator impersonates the popular `request` package (cloned README, bugs URL points at github.com/request/req...
OpenSSF/OSV malware advisory MAL-2026-2798 blocks this version. request-easy-validator impersonates the popular `request` package (cloned README, bugs URL points at github.com/request/req...
OpenSSF/OSV malware advisory MAL-2026-2798 blocks this version. request-easy-validator impersonates the popular `request` package (cloned README, bugs URL points at github.com/request/req...
OpenSSF/OSV malware advisory MAL-2026-6176 blocks this version. The npm package `request-tracking-sqlite` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React N...
OpenSSF/OSV malware advisory MAL-2026-6176 blocks this version. The npm package `request-tracking-sqlite` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React N...
OpenSSF/OSV malware advisory MAL-2026-4151 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4151 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-5310 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6474 blocks this version. On `npm install`, the package's postinstall hook runs `node test.js` which invokes index.js to perform multi-stage installe...
OpenSSF/OSV malware advisory MAL-2026-4254 blocks this version. package.json declares `preinstall: node index.js`, so installation automatically executes index.js. The script reads /etc/p...
OpenSSF/OSV malware advisory MAL-2026-4254 blocks this version. package.json declares `preinstall: node index.js`, so installation automatically executes index.js. The script reads /etc/p...
OpenSSF/OSV malware advisory MAL-2026-4254 blocks this version. package.json declares `preinstall: node index.js`, so installation automatically executes index.js. The script reads /etc/p...
OpenSSF/OSV malware advisory MAL-2026-4254 blocks this version. package.json declares `preinstall: node index.js`, so installation automatically executes index.js. The script reads /etc/p...
OpenSSF/OSV malware advisory MAL-2026-6137 blocks this version. Package name and README impersonate the popular react-error-boundary library (advertising an ErrorBoundary export, citing b...