npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 704
Updated 27 Oct 2026, 16:43 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-2930 blocks this version. The package presents itself as a copy of the Node.js core `path` module (name `path-internal`, README: "exact copy of the N...
OpenSSF/OSV malware advisory MAL-2026-2930 blocks this version. The package presents itself as a copy of the Node.js core `path` module (name `path-internal`, README: "exact copy of the N...
OpenSSF/OSV malware advisory MAL-2026-2930 blocks this version. The package presents itself as a copy of the Node.js core `path` module (name `path-internal`, README: "exact copy of the N...
OpenSSF/OSV malware advisory MAL-2026-2930 blocks this version. The package presents itself as a copy of the Node.js core `path` module (name `path-internal`, README: "exact copy of the N...
OpenSSF/OSV malware advisory MAL-2026-2930 blocks this version. The package presents itself as a copy of the Node.js core `path` module (name `path-internal`, README: "exact copy of the N...
OpenSSF/OSV malware advisory MAL-2026-4639 blocks this version. On require/load, index.js unconditionally collects host identifiers (hostname, username, platform, arch, cwd, pid) and send...
OpenSSF/OSV malware advisory MAL-2026-5737 blocks this version. The package name impersonates the widely-used postcss-selector-parser library (which it also declares as a dependency and r...
OpenSSF/OSV malware advisory MAL-2026-5737 blocks this version. The package name impersonates the widely-used postcss-selector-parser library (which it also declares as a dependency and r...
OpenSSF/OSV malware advisory MAL-2026-5737 blocks this version. The package name impersonates the widely-used postcss-selector-parser library (which it also declares as a dependency and r...
OpenSSF/OSV malware advisory MAL-2026-5737 blocks this version. The package name impersonates the widely-used postcss-selector-parser library (which it also declares as a dependency and r...
OpenSSF/OSV malware advisory MAL-2026-5737 blocks this version. The package name impersonates the widely-used postcss-selector-parser library (which it also declares as a dependency and r...
OpenSSF/OSV malware advisory MAL-2026-5737 blocks this version. The package name impersonates the widely-used postcss-selector-parser library (which it also declares as a dependency and r...
OpenSSF/OSV malware advisory MAL-2026-5737 blocks this version. The package name impersonates the widely-used postcss-selector-parser library (which it also declares as a dependency and r...
OpenSSF/OSV malware advisory MAL-2026-5737 blocks this version. The package name impersonates the widely-used postcss-selector-parser library (which it also declares as a dependency and r...
OpenSSF/OSV malware advisory MAL-2026-5737 blocks this version. The package name impersonates the widely-used postcss-selector-parser library (which it also declares as a dependency and r...
OpenSSF/OSV malware advisory MAL-2026-5738 blocks this version. On install, package.json's postinstall hook ("postinstall": "node run.js") triggers execution of bundled beacon scripts (be...
OpenSSF/OSV malware advisory MAL-2026-3412 blocks this version. The package post-purchase-bundler was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3412 blocks this version. The package post-purchase-bundler was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6194 blocks this version. On default invocation (e.g., `npx portloop` with no flags), the CLI runs in daemon+quiet+respawn mode and POSTs {id, hostna...
OpenSSF/OSV malware advisory MAL-2026-6194 blocks this version. On default invocation (e.g., `npx portloop` with no flags), the CLI runs in daemon+quiet+respawn mode and POSTs {id, hostna...
OpenSSF/OSV malware advisory MAL-2026-4643 blocks this version. The package is published as `polymarket-clob-client`, an unscoped lookalike of the legitimate `@polymarket/clob-client` mai...
OpenSSF/OSV malware advisory MAL-2026-3328 blocks this version. The package pocpoc2626 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3328 blocks this version. The package pocpoc2626 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4274 blocks this version. On `npm install`, postinstall.js executes `whoami`, `id`, and reads `os.hostname()`, `os.platform()`, `process.cwd()`, and...
OpenSSF/OSV malware advisory MAL-2026-4274 blocks this version. On `npm install`, postinstall.js executes `whoami`, `id`, and reads `os.hostname()`, `os.platform()`, `process.cwd()`, and...