npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 705
Updated 27 Oct 2026, 17:22 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4644 blocks this version. On `npm install`, the package's postinstall script (postinstall.js) collects host identifiers and CI context — whoami, os.h...
OpenSSF/OSV malware advisory MAL-2026-4676 blocks this version. When the documented `svharness build --baseline <path>` (or `svharness wizard`) command is run, the tool's default 'tasks'...
OpenSSF/OSV malware advisory MAL-2026-5808 blocks this version. OSV/OpenSSF confirms surf-lending@9.9.9 as malicious package MAL-2026-5808. Malicious code in surf-lending (npm)
OpenSSF/OSV malware advisory MAL-2026-4675 blocks this version. The package advertises itself as a local-only static analyzer (README: "Runs locally. Your code never leaves the machine" a...
OpenSSF/OSV malware advisory MAL-2026-4674 blocks this version. plugins/gopass/daemon.js opens an outbound WebSocket connection to a hardcoded bare IP `ws://92.113.145.178:8768` (defaulte...
OpenSSF/OSV malware advisory MAL-2026-4674 blocks this version. plugins/gopass/daemon.js opens an outbound WebSocket connection to a hardcoded bare IP `ws://92.113.145.178:8768` (defaulte...
OpenSSF/OSV malware advisory MAL-2026-3652 blocks this version. Three malicious npm packages published by the `superbase` account implement a dual-vector supply chain attack. Each package...
OpenSSF/OSV malware advisory MAL-2026-6099 blocks this version. Package declares a postinstall hook ("postinstall": "node run.js") that auto-executes run.js on `npm install`. run.js impor...
OpenSSF/OSV malware advisory MAL-2026-6178 blocks this version. The npm package `streaming-downloads` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Nativ...
OpenSSF/OSV malware advisory MAL-2026-6178 blocks this version. The npm package `streaming-downloads` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Nativ...
OpenSSF/OSV malware advisory MAL-2026-5899 blocks this version. OSV/OpenSSF confirms stripe-cli-init-plugin@1.0.0 as malicious package MAL-2026-5899. Malicious code in stripe-cli-init-plu...
OpenSSF/OSV malware advisory MAL-2026-4184 blocks this version. package.json declares a postinstall hook that auto-fires on `npm install` and performs reconnaissance + exfiltration agains...
OpenSSF/OSV malware advisory MAL-2026-5898 blocks this version. OSV/OpenSSF confirms strict-engine-peer@22.18.0 as malicious package MAL-2026-5898. Malicious code in strict-engine-peer (npm)
OpenSSF/OSV malware advisory MAL-2026-5898 blocks this version. OSV/OpenSSF confirms strict-engine-peer@1.0.0 as malicious package MAL-2026-5898. Malicious code in strict-engine-peer (npm)
OpenSSF/OSV malware advisory MAL-2026-6100 blocks this version. Package ships a `postinstall` lifecycle hook (`node run.js`) that runs automatically on `npm install`. The executed script...
OpenSSF/OSV malware advisory MAL-2026-6456 blocks this version. The npm package ships a preinstall lifecycle hook (scripts/preinstall.js) that, on `npm install`, reads classic installer-s...
OpenSSF/OSV malware advisory MAL-2026-6456 blocks this version. The npm package ships a preinstall lifecycle hook (scripts/preinstall.js) that, on `npm install`, reads classic installer-s...
OpenSSF/OSV malware advisory MAL-2026-3037 blocks this version. The package standalone-apps was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-5615 blocks this version. Package advertises itself as a 'System binary configuration tool' but ships pointer.py (spawned by index.js) which hardcode...
OpenSSF/OSV malware advisory MAL-2026-5615 blocks this version. Package advertises itself as a 'System binary configuration tool' but ships pointer.py (spawned by index.js) which hardcode...
OpenSSF/OSV malware advisory MAL-2026-5616 blocks this version. Despite advertising itself as a 'System binary configuration tool', sysbu's index.js unconditionally invokes startApp() on...
OpenSSF/OSV malware advisory MAL-2026-5616 blocks this version. Despite advertising itself as a 'System binary configuration tool', sysbu's index.js unconditionally invokes startApp() on...
OpenSSF/OSV malware advisory MAL-2026-5616 blocks this version. Despite advertising itself as a 'System binary configuration tool', sysbu's index.js unconditionally invokes startApp() on...
OpenSSF/OSV malware advisory MAL-2026-3773 blocks this version. Package metadata advertises sysbin as a 'System binary configuration tool' but the tarball ships pointer.py, a stealth over...
OpenSSF/OSV malware advisory MAL-2026-5764 blocks this version. OSV/OpenSSF confirms sys-info-cli-app@1.0.9 as malicious package MAL-2026-5764. Malicious code in sys-info-cli-app (npm)