npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 701
Updated 27 Oct 2026, 14:58 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4656 blocks this version. The package's rich-text editor module hardcodes an Azure OpenAI endpoint (https://aidevused.openai.azure.com/) and an api-k...
OpenSSF/OSV malware advisory MAL-2026-5132 blocks this version. The OpenSSF Package Analysis project identified 'rookie-security-test-pkg' @ 1.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-4663 blocks this version. package.json declares `"preinstall": "./bin/install-deps"`, which causes `npm install roidjs` to auto-execute `bin/install-...
OpenSSF/OSV malware advisory MAL-2026-6174 blocks this version. The npm package `pushnotifications-gesturerecognition` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a dece...
OpenSSF/OSV malware advisory MAL-2026-5077 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-4651 blocks this version. pulse-axios@1.16.1 declares a postinstall hook (`node./lib/core/eval.js`) that on `npm install` issues `fetch('http://local...
OpenSSF/OSV malware advisory MAL-2026-4651 blocks this version. pulse-axios@1.16.1 declares a postinstall hook (`node./lib/core/eval.js`) that on `npm install` issues `fetch('http://local...
OpenSSF/OSV malware advisory MAL-2026-4651 blocks this version. pulse-axios@1.16.1 declares a postinstall hook (`node./lib/core/eval.js`) that on `npm install` issues `fetch('http://local...
OpenSSF/OSV malware advisory MAL-2026-4650 blocks this version. package.json declares "preinstall": "node index.js", causing index.js to run automatically on npm install. The script colle...
OpenSSF/OSV malware advisory MAL-2026-4652 blocks this version. package.json declares "preinstall": "./dist/typecheck.js". The referenced file is not JavaScript — it is a 5,224,556-byte L...
OpenSSF/OSV malware advisory MAL-2026-4246 blocks this version. Package fetches and executes a mutable, unpinned third-party npm package (`env-security-scanner@latest`) on every install a...
OpenSSF/OSV malware advisory MAL-2026-6173 blocks this version. The npm package `profiling-keychain` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Native...
OpenSSF/OSV malware advisory MAL-2026-3039 blocks this version. The package process-app-task was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-5921 blocks this version. OSV/OpenSSF confirms proto-bin@2.5.3 as malicious package MAL-2026-5921. Malicious code in proto-bin (npm)
OpenSSF/OSV malware advisory MAL-2026-5921 blocks this version. OSV/OpenSSF confirms proto-bin@2.5.2 as malicious package MAL-2026-5921. Malicious code in proto-bin (npm)
OpenSSF/OSV malware advisory MAL-2026-5921 blocks this version. OSV/OpenSSF confirms proto-bin@2.5.1 as malicious package MAL-2026-5921. Malicious code in proto-bin (npm)
OpenSSF/OSV malware advisory MAL-2026-5921 blocks this version. OSV/OpenSSF confirms proto-bin@2.3.3 as malicious package MAL-2026-5921. Malicious code in proto-bin (npm)
OpenSSF/OSV malware advisory MAL-2026-4282 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4282 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4282 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4281 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4281 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4193 blocks this version. package.json declares a postinstall script that uses Node's child_process to execute reconnaissance commands (including `wh...
OpenSSF/OSV malware advisory MAL-2026-6493 blocks this version. The package ships a binding.gyp whose sources field uses GYP command-expansion syntax (<!(...)) at line 6. npm implicitly r...
OpenSSF/OSV malware advisory MAL-2026-4645 blocks this version. Package name `prettier-sdk` impersonates the top-tier `prettier` package (~50M weekly downloads), copying its README verbat...