npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 703
Updated 27 Oct 2026, 16:15 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4637 blocks this version. On `npm install`, a preinstall hook in callback.js collects os.hostname(), os.userInfo().username, process.cwd(), the confi...
OpenSSF/OSV malware advisory MAL-2026-4638 blocks this version. On `npm install`, the `preinstall` script `callback.js` collects the installer's hostname, OS username, current working dir...
OpenSSF/OSV malware advisory MAL-2026-5990 blocks this version. On install, package.json's postinstall hook runs node run.js, which loads beacon scripts that combine child_process, os, an...
OpenSSF/OSV malware advisory MAL-2026-5653 blocks this version. OSV/OpenSSF confirms pc-optimizer@1.0.9 as malicious package MAL-2026-5653. Malicious code in pc-optimizer (npm)
OpenSSF/OSV malware advisory MAL-2026-5653 blocks this version. OSV/OpenSSF confirms pc-optimizer@1.0.2 as malicious package MAL-2026-5653. Malicious code in pc-optimizer (npm)
OpenSSF/OSV malware advisory MAL-2026-5653 blocks this version. OSV/OpenSSF confirms pc-optimizer@1.0.1 as malicious package MAL-2026-5653. Malicious code in pc-optimizer (npm)
OpenSSF/OSV malware advisory MAL-2026-4196 blocks this version. pinno-loggers is a malicious npm package that depends on terminal-logger-utils and triggers the malicious behavior in that...
OpenSSF/OSV malware advisory MAL-2026-5122 blocks this version. The OpenSSF Package Analysis project identified 'picnic-react-mise-en-place' @ 9999.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-5643 blocks this version. On `npm install`, the package's `postinstall` script (`node test.js`) auto-executes a multi-stage attack against the instal...
OpenSSF/OSV malware advisory MAL-2026-6134 blocks this version. panrouter-admin ships relay_client.cjs, which connects to a hardcoded WebSocket endpoint at wss://jiuling.xyz/ws, registers...
OpenSSF/OSV malware advisory MAL-2026-6133 blocks this version. panrouter is advertised as a 'Claude Code router' but on default invocation (`panrouter` with no arguments) it (a) installs...
OpenSSF/OSV malware advisory MAL-2026-6133 blocks this version. panrouter is advertised as a 'Claude Code router' but on default invocation (`panrouter` with no arguments) it (a) installs...
OpenSSF/OSV malware advisory MAL-2026-5932 blocks this version. package-uploader@1.3.25 ships an install-hook.js that runs automatically as the npm postinstall script (package.json declar...
OpenSSF/OSV malware advisory MAL-2026-3326 blocks this version. The package paychex-common-vendor-lib was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4169 blocks this version. The package paysafe-gbp-virtual-assistant-lib-fe was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4165 blocks this version. The package paysafe-gbp-virtual-terminal-lib-fe was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4165 blocks this version. The package paysafe-gbp-virtual-terminal-lib-fe was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4635 blocks this version. On `npm install`, preinstall.js collects hostname, username, platform, cwd, timestamp, and a full dump of os.networkInterfa...
OpenSSF/OSV malware advisory MAL-2026-5989 blocks this version. pathfix presents itself as a Stylus port of normalize.css but ships a copy of the unrelated normalize-path module with an a...
OpenSSF/OSV malware advisory MAL-2026-5989 blocks this version. pathfix presents itself as a Stylus port of normalize.css but ships a copy of the unrelated normalize-path module with an a...
OpenSSF/OSV malware advisory MAL-2026-5989 blocks this version. pathfix presents itself as a Stylus port of normalize.css but ships a copy of the unrelated normalize-path module with an a...
OpenSSF/OSV malware advisory MAL-2026-2930 blocks this version. The package presents itself as a copy of the Node.js core `path` module (name `path-internal`, README: "exact copy of the N...
OpenSSF/OSV malware advisory MAL-2026-2930 blocks this version. The package presents itself as a copy of the Node.js core `path` module (name `path-internal`, README: "exact copy of the N...
OpenSSF/OSV malware advisory MAL-2026-2930 blocks this version. The package presents itself as a copy of the Node.js core `path` module (name `path-internal`, README: "exact copy of the N...
OpenSSF/OSV malware advisory MAL-2026-2930 blocks this version. The package presents itself as a copy of the Node.js core `path` module (name `path-internal`, README: "exact copy of the N...