npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 702
Updated 27 Oct 2026, 15:40 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6493 blocks this version. The package ships a binding.gyp whose sources field uses GYP command-expansion syntax (<!(...)) at line 6. npm implicitly r...
OpenSSF/OSV malware advisory MAL-2026-4645 blocks this version. Package name `prettier-sdk` impersonates the top-tier `prettier` package (~50M weekly downloads), copying its README verbat...
OpenSSF/OSV malware advisory MAL-2026-4197 blocks this version. pretty-logger-utils is a malicious npm package that depends on terminal-logger-utils and triggers the malicious behavior in...
OpenSSF/OSV malware advisory MAL-2026-5920 blocks this version. Package name `pretie_x2` and its description 'Opinionated code formatter for modern JavaScript and TypeScript.' (with keywo...
OpenSSF/OSV malware advisory MAL-2026-5920 blocks this version. Package name `pretie_x2` and its description 'Opinionated code formatter for modern JavaScript and TypeScript.' (with keywo...
OpenSSF/OSV malware advisory MAL-2026-5920 blocks this version. Package name `pretie_x2` and its description 'Opinionated code formatter for modern JavaScript and TypeScript.' (with keywo...
OpenSSF/OSV malware advisory MAL-2026-5920 blocks this version. Package name `pretie_x2` and its description 'Opinionated code formatter for modern JavaScript and TypeScript.' (with keywo...
OpenSSF/OSV malware advisory MAL-2026-5920 blocks this version. Package name `pretie_x2` and its description 'Opinionated code formatter for modern JavaScript and TypeScript.' (with keywo...
OpenSSF/OSV malware advisory MAL-2026-5919 blocks this version. Package masquerades as the prettier formatter (name pretie_x1, description "Opinionated code formatter for modern JavaScrip...
OpenSSF/OSV malware advisory MAL-2026-5919 blocks this version. Package masquerades as the prettier formatter (name pretie_x1, description "Opinionated code formatter for modern JavaScrip...
OpenSSF/OSV malware advisory MAL-2026-5919 blocks this version. Package masquerades as the prettier formatter (name pretie_x1, description "Opinionated code formatter for modern JavaScrip...
OpenSSF/OSV malware advisory MAL-2026-5919 blocks this version. Package masquerades as the prettier formatter (name pretie_x1, description "Opinionated code formatter for modern JavaScrip...
OpenSSF/OSV malware advisory MAL-2026-5919 blocks this version. Package masquerades as the prettier formatter (name pretie_x1, description "Opinionated code formatter for modern JavaScrip...
OpenSSF/OSV malware advisory MAL-2026-6355 blocks this version. On `npm install`, package.json's `preinstall` hook runs index.js, which collects host identifiers (os.hostname(), os.userIn...
OpenSSF/OSV malware advisory MAL-2026-3374 blocks this version. The package playgod was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6172 blocks this version. The npm package `platformspecific-webgl` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Na...
OpenSSF/OSV malware advisory MAL-2026-4641 blocks this version. platform-tempo@99.0.1 declares a `preinstall` hook that runs `poc.js` on every `npm install`. The script collects host iden...
OpenSSF/OSV malware advisory MAL-2026-6171 blocks this version. The npm package `personal-custom-button` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Na...
OpenSSF/OSV malware advisory MAL-2026-6171 blocks this version. The npm package `personal-custom-button` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Na...
OpenSSF/OSV malware advisory MAL-2026-6171 blocks this version. The npm package `personal-custom-button` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Na...
OpenSSF/OSV malware advisory MAL-2026-6171 blocks this version. The npm package `personal-custom-button` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Na...
OpenSSF/OSV malware advisory MAL-2026-6171 blocks this version. The npm package `personal-custom-button` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Na...
OpenSSF/OSV malware advisory MAL-2026-6171 blocks this version. The npm package `personal-custom-button` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Na...
OpenSSF/OSV malware advisory MAL-2026-6171 blocks this version. The npm package `personal-custom-button` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Na...
OpenSSF/OSV malware advisory MAL-2026-4637 blocks this version. On `npm install`, a preinstall hook in callback.js collects os.hostname(), os.userInfo().username, process.cwd(), the confi...