npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 709
Updated 27 Oct 2026, 19:44 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5558 blocks this version. OSV/OpenSSF confirms sensivity@2.5.26 as malicious package MAL-2026-5558. Malicious code in sensivity (npm)
OpenSSF/OSV malware advisory MAL-2026-5558 blocks this version. OSV/OpenSSF confirms sensivity@2.5.25 as malicious package MAL-2026-5558. Malicious code in sensivity (npm)
OpenSSF/OSV malware advisory MAL-2026-5558 blocks this version. OSV/OpenSSF confirms sensivity@2.5.24 as malicious package MAL-2026-5558. Malicious code in sensivity (npm)
OpenSSF/OSV malware advisory MAL-2026-5558 blocks this version. OSV/OpenSSF confirms sensivity@2.5.23 as malicious package MAL-2026-5558. Malicious code in sensivity (npm)
OpenSSF/OSV malware advisory MAL-2026-5558 blocks this version. OSV/OpenSSF confirms sensivity@2.5.22 as malicious package MAL-2026-5558. Malicious code in sensivity (npm)
OpenSSF/OSV malware advisory MAL-2026-5558 blocks this version. OSV/OpenSSF confirms sensivity@2.5.21 as malicious package MAL-2026-5558. Malicious code in sensivity (npm)
OpenSSF/OSV malware advisory MAL-2026-5558 blocks this version. OSV/OpenSSF confirms sensivity@2.5.20 as malicious package MAL-2026-5558. Malicious code in sensivity (npm)
OpenSSF/OSV malware advisory MAL-2026-5558 blocks this version. OSV/OpenSSF confirms sensivity@2.5.2 as malicious package MAL-2026-5558. Malicious code in sensivity (npm)
OpenSSF/OSV malware advisory MAL-2026-5558 blocks this version. OSV/OpenSSF confirms sensivity@2.5.19 as malicious package MAL-2026-5558. Malicious code in sensivity (npm)
OpenSSF/OSV malware advisory MAL-2026-5558 blocks this version. OSV/OpenSSF confirms sensivity@2.5.18 as malicious package MAL-2026-5558. Malicious code in sensivity (npm)
OpenSSF/OSV malware advisory MAL-2026-5558 blocks this version. OSV/OpenSSF confirms sensivity@2.5.17 as malicious package MAL-2026-5558. Malicious code in sensivity (npm)
OpenSSF/OSV malware advisory MAL-2026-5558 blocks this version. OSV/OpenSSF confirms sensivity@2.5.16 as malicious package MAL-2026-5558. Malicious code in sensivity (npm)
OpenSSF/OSV malware advisory MAL-2026-5558 blocks this version. OSV/OpenSSF confirms sensivity@2.5.15 as malicious package MAL-2026-5558. Malicious code in sensivity (npm)
OpenSSF/OSV malware advisory MAL-2026-5558 blocks this version. OSV/OpenSSF confirms sensivity@2.5.14 as malicious package MAL-2026-5558. Malicious code in sensivity (npm)
OpenSSF/OSV malware advisory MAL-2026-5558 blocks this version. OSV/OpenSSF confirms sensivity@2.5.13 as malicious package MAL-2026-5558. Malicious code in sensivity (npm)
OpenSSF/OSV malware advisory MAL-2026-5558 blocks this version. OSV/OpenSSF confirms sensivity@2.5.12 as malicious package MAL-2026-5558. Malicious code in sensivity (npm)
OpenSSF/OSV malware advisory MAL-2026-5558 blocks this version. OSV/OpenSSF confirms sensivity@2.5.11 as malicious package MAL-2026-5558. Malicious code in sensivity (npm)
OpenSSF/OSV malware advisory MAL-2026-5558 blocks this version. OSV/OpenSSF confirms sensivity@2.5.10 as malicious package MAL-2026-5558. Malicious code in sensivity (npm)
OpenSSF/OSV malware advisory MAL-2026-5558 blocks this version. OSV/OpenSSF confirms sensivity@2.5.1 as malicious package MAL-2026-5558. Malicious code in sensivity (npm)
OpenSSF/OSV malware advisory MAL-2026-5558 blocks this version. OSV/OpenSSF confirms sensivity@2.5.0 as malicious package MAL-2026-5558. Malicious code in sensivity (npm)
OpenSSF/OSV malware advisory MAL-2026-5644 blocks this version. The package presents itself as a self-signed certificate generator, but its public generateCertificates() API path loads sa...
OpenSSF/OSV malware advisory MAL-2026-5644 blocks this version. The package presents itself as a self-signed certificate generator, but its public generateCertificates() API path loads sa...
OpenSSF/OSV malware advisory MAL-2026-4667 blocks this version. When a user selects the advertised `deepseek-cn` provider, the package's `defaultBaseUrlForProvider` function in dist/chunk...
OpenSSF/OSV malware advisory MAL-2026-4667 blocks this version. When a user selects the advertised `deepseek-cn` provider, the package's `defaultBaseUrlForProvider` function in dist/chunk...
OpenSSF/OSV malware advisory MAL-2026-4667 blocks this version. When a user selects the advertised `deepseek-cn` provider, the package's `defaultBaseUrlForProvider` function in dist/chunk...