npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 710
Updated 27 Oct 2026, 20:26 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4667 blocks this version. When a user selects the advertised `deepseek-cn` provider, the package's `defaultBaseUrlForProvider` function in dist/chunk...
OpenSSF/OSV malware advisory MAL-2026-4667 blocks this version. When a user selects the advertised `deepseek-cn` provider, the package's `defaultBaseUrlForProvider` function in dist/chunk...
OpenSSF/OSV malware advisory MAL-2026-4667 blocks this version. When a user selects the advertised `deepseek-cn` provider, the package's `defaultBaseUrlForProvider` function in dist/chunk...
OpenSSF/OSV malware advisory MAL-2026-4263 blocks this version. On `npm install`, postinstall.js executes `whoami` via child_process and reads os.hostname(), os.platform(), the working di...
OpenSSF/OSV malware advisory MAL-2026-4263 blocks this version. On `npm install`, postinstall.js executes `whoami` via child_process and reads os.hostname(), os.platform(), the working di...
OpenSSF/OSV malware advisory MAL-2026-4263 blocks this version. On `npm install`, postinstall.js executes `whoami` via child_process and reads os.hostname(), os.platform(), the working di...
OpenSSF/OSV malware advisory MAL-2026-4665 blocks this version. Package impersonates the popular dotenv library (identical description and repo URL git://github.com/motdotla/dotenv.git) a...
OpenSSF/OSV malware advisory MAL-2026-6264 blocks this version. search-from-feed@999.0.0 is a dependency-confusion attack package. package.json declares both `preinstall` and `postinstall...
OpenSSF/OSV malware advisory MAL-2026-6277 blocks this version. package.json registers `node callback.js` as both `preinstall` and `postinstall`, so the payload runs automatically on `npm...
OpenSSF/OSV malware advisory MAL-2026-4664 blocks this version. package.json declares `preinstall: node index.js`, which fires automatically on `npm install`. index.js collects host ident...
OpenSSF/OSV malware advisory MAL-2026-6500 blocks this version. Package masquerades as js-cookie (same banner `/*! js-cookie v3.0.5 | MIT */`, README, and `repository.url: git://github.co...
OpenSSF/OSV malware advisory MAL-2026-5859 blocks this version. package.json registers both `preinstall` and `postinstall` lifecycle hooks that run `node callback.js`, which executes auto...
OpenSSF/OSV malware advisory MAL-2026-5859 blocks this version. package.json registers both `preinstall` and `postinstall` lifecycle hooks that run `node callback.js`, which executes auto...
OpenSSF/OSV malware advisory MAL-2026-5859 blocks this version. package.json registers both `preinstall` and `postinstall` lifecycle hooks that run `node callback.js`, which executes auto...
OpenSSF/OSV malware advisory MAL-2026-4670 blocks this version. On `npm install`, postinstall.js executes `whoami` and `id` via child_process.execSync, collects os.hostname(), os.platform...
OpenSSF/OSV malware advisory MAL-2026-4670 blocks this version. On `npm install`, postinstall.js executes `whoami` and `id` via child_process.execSync, collects os.hostname(), os.platform...
OpenSSF/OSV malware advisory MAL-2026-6455 blocks this version. Package name 'simple-node-calc-ccc' presents as a trivial calculator but ships lodash-compiler.js, an 87KB obfuscator.io-pa...
OpenSSF/OSV malware advisory MAL-2026-6454 blocks this version. Package advertises itself as a 7-function calculator but ships an undeclared 87KB heavily obfuscated file `lodash-compiler....
OpenSSF/OSV malware advisory MAL-2026-6453 blocks this version. simple-node-calc-b@1.0.0 ships a binding.gyp that includes a `modules` file declaring `"lodash": "<!(node lodash-compiler.j...
OpenSSF/OSV malware advisory MAL-2026-6452 blocks this version. Package advertises itself as a trivial arithmetic helper but ships a binding.gyp whose `sources` list uses gyp's `<!(...)`...
OpenSSF/OSV malware advisory MAL-2026-6451 blocks this version. simple-node-calc-a@1.0.0 advertises itself as a pure-JS calculator but ships a binding.gyp that triggers node-gyp automatic...
OpenSSF/OSV malware advisory MAL-2026-4178 blocks this version. The OpenSSF Package Analysis project identified 'sickle-wrapper' @ 0.2.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-4153 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4153 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4153 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...