npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 718
Updated 28 Oct 2026, 01:23 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3721 blocks this version. The OpenSSF Package Analysis project identified 'npmjs_ethers-common' @ 2.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-3768 blocks this version. The package's `postinstall` lifecycle hook downloads a script from a personal GitHub Gist (`gist.githubusercontent.com/guel...
OpenSSF/OSV malware advisory MAL-2026-3723 blocks this version. The package.json defines a postinstall lifecycle hook that invokes child_process.exec to run `curl -s https://gist.githubus...
OpenSSF/OSV malware advisory MAL-2026-3722 blocks this version. The OpenSSF Package Analysis project identified 'npmjs_hardhat-common' @ 2.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-6363 blocks this version. The package's main module (index.js) exports an `init()` function that spawns `/bin/bash` via `child_process.exec` and open...
OpenSSF/OSV malware advisory MAL-2026-6363 blocks this version. The package's main module (index.js) exports an `init()` function that spawns `/bin/bash` via `child_process.exec` and open...
OpenSSF/OSV malware advisory MAL-2026-6363 blocks this version. The package's main module (index.js) exports an `init()` function that spawns `/bin/bash` via `child_process.exec` and open...
OpenSSF/OSV malware advisory MAL-2026-6363 blocks this version. The package's main module (index.js) exports an `init()` function that spawns `/bin/bash` via `child_process.exec` and open...
OpenSSF/OSV malware advisory MAL-2026-3339 blocks this version. The package nf-ui-components was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3339 blocks this version. The package nf-ui-components was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-5984 blocks this version. OSV/OpenSSF confirms nepublisher@0.4.0 as malicious package MAL-2026-5984. Malicious code in nepublisher (npm)
OpenSSF/OSV malware advisory MAL-2026-5121 blocks this version. The OpenSSF Package Analysis project identified 'nepsnowplow' @ 9999.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-4836 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3241 blocks this version. The package nextjs-chat-with-ai-service was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3589 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3589 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3589 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3589 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3589 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6227 blocks this version. index.js imports child_process and at lines 101 and 117 invokes execSync to run bash and zsh commands. Lines 9, 194, and 19...
OpenSSF/OSV malware advisory MAL-2026-6225 blocks this version. Package is published as 'new-eslint-1' but its package.json description, README, repository URL (MikeMcl/big.js), and sourc...
OpenSSF/OSV malware advisory MAL-2026-6283 blocks this version. The package publishes verbatim big.js v7.0.1 source (including the upstream copyright header, README, repository URL pointi...
OpenSSF/OSV malware advisory MAL-2026-6197 blocks this version. Package 'new-ecro' impersonates the legitimate 'big.js' library: it copies big.js's README, source, version banner ('big.js...
OpenSSF/OSV malware advisory MAL-2026-6197 blocks this version. Package 'new-ecro' impersonates the legitimate 'big.js' library: it copies big.js's README, source, version banner ('big.js...
OpenSSF/OSV malware advisory MAL-2026-6197 blocks this version. Package 'new-ecro' impersonates the legitimate 'big.js' library: it copies big.js's README, source, version banner ('big.js...