npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 719
Updated 28 Oct 2026, 01:57 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6226 blocks this version. Package is published under the unrelated name 'new-mjs-eslint' but ships a verbatim copy of the big.js decimal-arithmetic l...
OpenSSF/OSV malware advisory MAL-2026-5794 blocks this version. OSV/OpenSSF confirms neural-network-scan@1.0.9 as malicious package MAL-2026-5794. Malicious code in neural-network-scan (npm)
OpenSSF/OSV malware advisory MAL-2026-5794 blocks this version. OSV/OpenSSF confirms neural-network-scan@1.0.8 as malicious package MAL-2026-5794. Malicious code in neural-network-scan (npm)
OpenSSF/OSV malware advisory MAL-2026-5794 blocks this version. OSV/OpenSSF confirms neural-network-scan@1.0.2 as malicious package MAL-2026-5794. Malicious code in neural-network-scan (npm)
OpenSSF/OSV malware advisory MAL-2026-5794 blocks this version. OSV/OpenSSF confirms neural-network-scan@1.0.1 as malicious package MAL-2026-5794. Malicious code in neural-network-scan (npm)
OpenSSF/OSV malware advisory MAL-2026-4620 blocks this version. utils/BotClient.js hardcodes a Feishu/Lark appId (cli_a88b12e0b9b51013) and appSecret (aBRv7CbiWuL7csrMavfLvc5sMW5B4Ky7) as...
OpenSSF/OSV malware advisory MAL-2026-5836 blocks this version. OSV/OpenSSF confirms nic-datagov@1.0.0 as malicious package MAL-2026-5836. Malicious code in nic-datagov (npm)
OpenSSF/OSV malware advisory MAL-2026-6450 blocks this version. The CLI in bin/hibase32.js computes SHA256 of user input and, on one hardcoded magic digest ('bb9d5bbbd62fc66b63c0866b12656...
OpenSSF/OSV malware advisory MAL-2026-6399 blocks this version. On import, normalize-plus's top-level initPlugin() performs an HTTP GET against https://jsonkeeper.com/b/CI3HT, parses the...
OpenSSF/OSV malware advisory MAL-2026-5897 blocks this version. OSV/OpenSSF confirms noderzero@1.0.5 as malicious package MAL-2026-5897. Malicious code in noderzero (npm)
OpenSSF/OSV malware advisory MAL-2026-5897 blocks this version. OSV/OpenSSF confirms noderzero@1.0.3 as malicious package MAL-2026-5897. Malicious code in noderzero (npm)
OpenSSF/OSV malware advisory MAL-2026-5897 blocks this version. OSV/OpenSSF confirms noderzero@1.0.2 as malicious package MAL-2026-5897. Malicious code in noderzero (npm)
OpenSSF/OSV malware advisory MAL-2026-5897 blocks this version. OSV/OpenSSF confirms noderzero@1.0.1 as malicious package MAL-2026-5897. Malicious code in noderzero (npm)
OpenSSF/OSV malware advisory MAL-2026-4280 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-5736 blocks this version. OSV/OpenSSF confirms node-stack-frames@4.0.0 as malicious package MAL-2026-5736. Malicious code in node-stack-frames (npm)
OpenSSF/OSV malware advisory MAL-2026-6191 blocks this version. On `npm install`, package.json's postinstall hook executes `node test.js` which invokes code in index.js that performs two...
OpenSSF/OSV malware advisory MAL-2026-6191 blocks this version. On `npm install`, package.json's postinstall hook executes `node test.js` which invokes code in index.js that performs two...
OpenSSF/OSV malware advisory MAL-2026-6191 blocks this version. On `npm install`, package.json's postinstall hook executes `node test.js` which invokes code in index.js that performs two...
OpenSSF/OSV malware advisory MAL-2026-5985 blocks this version. Package name `node-path-utils` and its README/description claim it is 'an exact copy of the NodeJS path module', impersonat...
OpenSSF/OSV malware advisory MAL-2026-3744 blocks this version. Three versions of node-ipc (9.1.6, 9.2.3, 12.0.1) were published to npm on May 14, 2026 by a compromised maintainer account...
OpenSSF/OSV malware advisory MAL-2026-3744 blocks this version. Three versions of node-ipc (9.1.6, 9.2.3, 12.0.1) were published to npm on May 14, 2026 by a compromised maintainer account...
OpenSSF/OSV malware advisory MAL-2026-3744 blocks this version. Three versions of node-ipc (9.1.6, 9.2.3, 12.0.1) were published to npm on May 14, 2026 by a compromised maintainer account...
OpenSSF/OSV malware advisory MAL-2026-6276 blocks this version. scripts/postinstall.js runs automatically on `npm install` (Windows only) and behaves as a classic install-time dropper. It...
OpenSSF/OSV malware advisory MAL-2026-6276 blocks this version. scripts/postinstall.js runs automatically on `npm install` (Windows only) and behaves as a classic install-time dropper. It...
OpenSSF/OSV malware advisory MAL-2026-3767 blocks this version. On `require('node-ci-utils')`, index.js runs a top-level `_init()` that, on Linux, creates a hidden directory `~/.local/sha...