npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 716
Updated 28 Oct 2026, 00:08 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6353 blocks this version. Package name 'markdownlint-cli2-fix' impersonates the popular 'markdownlint-cli2' linter but contains no linter functionali...
OpenSSF/OSV malware advisory MAL-2026-6378 blocks this version. On first require of the package, index.js decodes a base64-encoded URL (https://api.ingress-hub.com/cdn/assets/update.pkg)...
OpenSSF/OSV malware advisory MAL-2026-6168 blocks this version. The npm package `macos-contentprovider-optimizingassets` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a de...
OpenSSF/OSV malware advisory MAL-2026-4607 blocks this version. maxixy-cli is a wholesale rebrand of QwenLM/qwen-code (itself a fork of google-gemini/gemini-cli) with the Qwen OAuth devic...
OpenSSF/OSV malware advisory MAL-2026-2926 blocks this version. The package material-ui-plugin-cache-endpoint was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4614 blocks this version. package.json declares `preinstall: node index.js`, which fires automatically on `npm install`. index.js collects host ident...
OpenSSF/OSV malware advisory MAL-2026-4613 blocks this version. monade@0.0.7 advertises itself as a JavaScript monad/flow utility library (cjs/index.js exports flow, of, opt, ka, dev), ye...
OpenSSF/OSV malware advisory MAL-2026-6362 blocks this version. On `npm install`, the package's postinstall hook (`package.json` declares `"postinstall": "node bin/cli.js"`) automatically...
OpenSSF/OSV malware advisory MAL-2026-6362 blocks this version. On `npm install`, the package's postinstall hook (`package.json` declares `"postinstall": "node bin/cli.js"`) automatically...
OpenSSF/OSV malware advisory MAL-2026-6362 blocks this version. On `npm install`, the package's postinstall hook (`package.json` declares `"postinstall": "node bin/cli.js"`) automatically...
OpenSSF/OSV malware advisory MAL-2026-4279 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-5347 blocks this version. OSV/OpenSSF confirms moustick@1.2.2 as malicious package MAL-2026-5347. Malicious code in moustick (npm)
OpenSSF/OSV malware advisory MAL-2026-5347 blocks this version. OSV/OpenSSF confirms moustick@1.2.1 as malicious package MAL-2026-5347. Malicious code in moustick (npm)
OpenSSF/OSV malware advisory MAL-2026-4615 blocks this version. This package masquerades as the `pino` logger (README copied from pino, exports `module.exports.pino = middleware`) but its...
OpenSSF/OSV malware advisory MAL-2026-4208 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4208 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4208 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4208 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4208 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4208 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4208 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4208 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4208 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4208 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4208 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...