npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 700
Updated 27 Oct 2026, 14:12 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4150 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4150 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4791 blocks this version. react-cleaner@1.0.4 is a pino-logger impersonator (package main is pino.js, homepage https://getpino.io, module layout mirr...
OpenSSF/OSV malware advisory MAL-2026-4791 blocks this version. react-cleaner@1.0.4 is a pino-logger impersonator (package main is pino.js, homepage https://getpino.io, module layout mirr...
OpenSSF/OSV malware advisory MAL-2026-6395 blocks this version. On `npm install`, the package runs `node postinstall.js` (declared in package.json `scripts.postinstall`) which performs un...
OpenSSF/OSV malware advisory MAL-2026-6395 blocks this version. On `npm install`, the package runs `node postinstall.js` (declared in package.json `scripts.postinstall`) which performs un...
OpenSSF/OSV malware advisory MAL-2026-4784 blocks this version. Package advertises itself as React polyfills / UI compatibility helpers but ships no React or polyfill code. The exported g...
OpenSSF/OSV malware advisory MAL-2026-4784 blocks this version. Package advertises itself as React polyfills / UI compatibility helpers but ships no React or polyfill code. The exported g...
OpenSSF/OSV malware advisory MAL-2026-5933 blocks this version. OSV/OpenSSF confirms react-vite-assert@1.4.1 as malicious package MAL-2026-5933. Malicious code in react-vite-assert (npm)
OpenSSF/OSV malware advisory MAL-2026-4661 blocks this version. react-tracked-tony impersonates the popular react-tracked package: package.json sets `name: react-tracked-tony`, `author: D...
OpenSSF/OSV malware advisory MAL-2026-5634 blocks this version. OSV/OpenSSF confirms react-photo-views@1.0.1 as malicious package MAL-2026-5634. Malicious code in react-photo-views (npm)
OpenSSF/OSV malware advisory MAL-2026-4660 blocks this version. Package name impersonates React and the package.json copies React's description, homepage (react.dev), bugs URL, and canary...
OpenSSF/OSV malware advisory MAL-2026-3262 blocks this version. Dependency confusion and typosquatting campaign by threat actor "saif777". Packages use inflated version numbers (9999.9999...
OpenSSF/OSV malware advisory MAL-2026-4780 blocks this version. On startup, plugmem_mcp.mjs writes <cwd>/.reasonix/settings.json registering PostToolUse and UserPromptSubmit hooks that ex...
OpenSSF/OSV malware advisory MAL-2026-5092 blocks this version. The OpenSSF Package Analysis project identified 'retail-location-strategy-frontend' @ 1.1.1 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-5092 blocks this version. The OpenSSF Package Analysis project identified 'retail-location-strategy-frontend' @ 1.1.1 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-3772 blocks this version. rimraf-utils@1.0.5 impersonates the widely-installed `rimraf` package (index.js is a dummy stub that internally identifies...
OpenSSF/OSV malware advisory MAL-2026-3772 blocks this version. rimraf-utils@1.0.5 impersonates the widely-installed `rimraf` package (index.js is a dummy stub that internally identifies...
OpenSSF/OSV malware advisory MAL-2026-3772 blocks this version. rimraf-utils@1.0.5 impersonates the widely-installed `rimraf` package (index.js is a dummy stub that internally identifies...
OpenSSF/OSV malware advisory MAL-2026-5852 blocks this version. OSV/OpenSSF confirms richtext-editor-ui@1.0.0 as malicious package MAL-2026-5852. Malicious code in richtext-editor-ui (npm)
OpenSSF/OSV malware advisory MAL-2026-4152 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4658 blocks this version. Package self-presents as a TypeScript SDK for the Rapyd fintech-as-a-service platform and links https://www.rapyd-client.ne...
OpenSSF/OSV malware advisory MAL-2026-4657 blocks this version. The package's main module (index.js lines 6-10) exports a function `mal` that opens a TCP socket to 223.229.156.10:5513 and...
OpenSSF/OSV malware advisory MAL-2026-4657 blocks this version. The package's main module (index.js lines 6-10) exports a function `mal` that opens a TCP socket to 223.229.156.10:5513 and...
OpenSSF/OSV malware advisory MAL-2026-4657 blocks this version. The package's main module (index.js lines 6-10) exports a function `mal` that opens a TCP socket to 223.229.156.10:5513 and...