npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 711
Updated 27 Oct 2026, 21:10 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4153 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4153 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4153 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-5490 blocks this version. OSV/OpenSSF confirms sb-original@9999.99.99 as malicious package MAL-2026-5490. Malicious code in sb-original (npm)
OpenSSF/OSV malware advisory MAL-2026-5452 blocks this version. OSV/OpenSSF confirms shopify-app-bridge-internal@99.9.9 as malicious package MAL-2026-5452. Malicious code in shopify-app-b...
OpenSSF/OSV malware advisory MAL-2026-4807 blocks this version. On `npm install`, the package's postinstall script (`postinstall.js`, run via `scripts.postinstall = 'node postinstall.js'`...
OpenSSF/OSV malware advisory MAL-2026-4806 blocks this version. The package exports a single function shizukuCh(socket) that accepts a caller's authenticated Baileys WhatsApp socket and i...
OpenSSF/OSV malware advisory MAL-2026-4669 blocks this version. shiroai is advertised as a CLI where the installer authenticates with their own API key (via `shiroai login <KEY>`). In pra...
OpenSSF/OSV malware advisory MAL-2026-4669 blocks this version. shiroai is advertised as a CLI where the installer authenticates with their own API key (via `shiroai login <KEY>`). In pra...
OpenSSF/OSV malware advisory MAL-2026-4669 blocks this version. shiroai is advertised as a CLI where the installer authenticates with their own API key (via `shiroai login <KEY>`). In pra...
OpenSSF/OSV malware advisory MAL-2026-4669 blocks this version. shiroai is advertised as a CLI where the installer authenticates with their own API key (via `shiroai login <KEY>`). In pra...
OpenSSF/OSV malware advisory MAL-2026-4669 blocks this version. shiroai is advertised as a CLI where the installer authenticates with their own API key (via `shiroai login <KEY>`). In pra...
OpenSSF/OSV malware advisory MAL-2026-4669 blocks this version. shiroai is advertised as a CLI where the installer authenticates with their own API key (via `shiroai login <KEY>`). In pra...
OpenSSF/OSV malware advisory MAL-2026-5993 blocks this version. OSV/OpenSSF confirms sheratan_test_p@1.0.0 as malicious package MAL-2026-5993. Malicious code in sheratan_test_p (npm)
OpenSSF/OSV malware advisory MAL-2026-5739 blocks this version. OSV/OpenSSF confirms sheratan_haha@1.0.1 as malicious package MAL-2026-5739. Malicious code in sheratan_haha (npm)
OpenSSF/OSV malware advisory MAL-2026-5739 blocks this version. OSV/OpenSSF confirms sheratan_haha@1.0.0 as malicious package MAL-2026-5739. Malicious code in sheratan_haha (npm)
OpenSSF/OSV malware advisory MAL-2026-5807 blocks this version. sam-package@1.2.1 is a malicious package whose only purpose is to deliver a prompt-injection payload targeting AI coding as...
OpenSSF/OSV malware advisory MAL-2026-5807 blocks this version. sam-package@1.2.1 is a malicious package whose only purpose is to deliver a prompt-injection payload targeting AI coding as...
OpenSSF/OSV malware advisory MAL-2026-5807 blocks this version. sam-package@1.2.1 is a malicious package whose only purpose is to deliver a prompt-injection payload targeting AI coding as...
OpenSSF/OSV malware advisory MAL-2026-5807 blocks this version. sam-package@1.2.1 is a malicious package whose only purpose is to deliver a prompt-injection payload targeting AI coding as...
OpenSSF/OSV malware advisory MAL-2026-5807 blocks this version. sam-package@1.2.1 is a malicious package whose only purpose is to deliver a prompt-injection payload targeting AI coding as...
OpenSSF/OSV malware advisory MAL-2026-5807 blocks this version. sam-package@1.2.1 is a malicious package whose only purpose is to deliver a prompt-injection payload targeting AI coding as...
OpenSSF/OSV malware advisory MAL-2026-5807 blocks this version. sam-package@1.2.1 is a malicious package whose only purpose is to deliver a prompt-injection payload targeting AI coding as...
OpenSSF/OSV malware advisory MAL-2026-5807 blocks this version. sam-package@1.2.1 is a malicious package whose only purpose is to deliver a prompt-injection payload targeting AI coding as...
OpenSSF/OSV malware advisory MAL-2026-5807 blocks this version. sam-package@1.2.1 is a malicious package whose only purpose is to deliver a prompt-injection payload targeting AI coding as...