npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 712
Updated 27 Oct 2026, 21:49 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5807 blocks this version. sam-package@1.2.1 is a malicious package whose only purpose is to deliver a prompt-injection payload targeting AI coding as...
OpenSSF/OSV malware advisory MAL-2026-5807 blocks this version. sam-package@1.2.1 is a malicious package whose only purpose is to deliver a prompt-injection payload targeting AI coding as...
OpenSSF/OSV malware advisory MAL-2026-5807 blocks this version. sam-package@1.2.1 is a malicious package whose only purpose is to deliver a prompt-injection payload targeting AI coding as...
OpenSSF/OSV malware advisory MAL-2026-5807 blocks this version. sam-package@1.2.1 is a malicious package whose only purpose is to deliver a prompt-injection payload targeting AI coding as...
OpenSSF/OSV malware advisory MAL-2026-5807 blocks this version. sam-package@1.2.1 is a malicious package whose only purpose is to deliver a prompt-injection payload targeting AI coding as...
OpenSSF/OSV malware advisory MAL-2026-5807 blocks this version. sam-package@1.2.1 is a malicious package whose only purpose is to deliver a prompt-injection payload targeting AI coding as...
OpenSSF/OSV malware advisory MAL-2026-5807 blocks this version. sam-package@1.2.1 is a malicious package whose only purpose is to deliver a prompt-injection payload targeting AI coding as...
OpenSSF/OSV malware advisory MAL-2026-5807 blocks this version. sam-package@1.2.1 is a malicious package whose only purpose is to deliver a prompt-injection payload targeting AI coding as...
OpenSSF/OSV malware advisory MAL-2026-5807 blocks this version. sam-package@1.2.1 is a malicious package whose only purpose is to deliver a prompt-injection payload targeting AI coding as...
OpenSSF/OSV malware advisory MAL-2026-5807 blocks this version. sam-package@1.2.1 is a malicious package whose only purpose is to deliver a prompt-injection payload targeting AI coding as...
OpenSSF/OSV malware advisory MAL-2026-6356 blocks this version. package.json declares a postinstall hook ("postinstall": "node run.js") that executes run.js automatically on `npm install`...
OpenSSF/OSV malware advisory MAL-2026-3590 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3590 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5028 blocks this version. sorenson-webfonts@99.9.1 is a hollow package: index.js is a 2-line stub (`'use strict'; module.exports = {};`), author/desc...
OpenSSF/OSV malware advisory MAL-2026-3715 blocks this version. package.json's postinstall lifecycle script runs `node -e` to base64-decode a hidden URL and pipe its contents to bash: `cu...
OpenSSF/OSV malware advisory MAL-2026-3715 blocks this version. package.json's postinstall lifecycle script runs `node -e` to base64-decode a hidden URL and pipe its contents to bash: `cu...
OpenSSF/OSV malware advisory MAL-2026-4247 blocks this version. On npm install, package.json's postinstall hook runs `node -e` to issue an https.get against `rqnyz-2605-7280-7--2000-c51.r...
OpenSSF/OSV malware advisory MAL-2026-6436 blocks this version. The `solo-nav` npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On...
OpenSSF/OSV malware advisory MAL-2026-4248 blocks this version. Package name 'solna-web3' is a one-character typosquat of the popular '@solana/web3.js' (drops the 'a' from 'solana'). The...
OpenSSF/OSV malware advisory MAL-2026-4218 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4218 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4218 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4218 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4218 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4218 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...