npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 720
Updated 28 Oct 2026, 02:30 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5733 blocks this version. OSV/OpenSSF confirms node-app-doctor@1.0.9 as malicious package MAL-2026-5733. Malicious code in node-app-doctor (npm)
OpenSSF/OSV malware advisory MAL-2026-5733 blocks this version. OSV/OpenSSF confirms node-app-doctor@1.0.2 as malicious package MAL-2026-5733. Malicious code in node-app-doctor (npm)
OpenSSF/OSV malware advisory MAL-2026-5733 blocks this version. OSV/OpenSSF confirms node-app-doctor@1.0.1 as malicious package MAL-2026-5733. Malicious code in node-app-doctor (npm)
OpenSSF/OSV malware advisory MAL-2026-3766 blocks this version. The package declares `scripts.postinstall: node postinstall.js`, which runs automatically on `npm install`. The script is a...
OpenSSF/OSV malware advisory MAL-2026-3766 blocks this version. The package declares `scripts.postinstall: node postinstall.js`, which runs automatically on `npm install`. The script is a...
OpenSSF/OSV malware advisory MAL-2026-3766 blocks this version. The package declares `scripts.postinstall: node postinstall.js`, which runs automatically on `npm install`. The script is a...
OpenSSF/OSV malware advisory MAL-2026-3766 blocks this version. The package declares `scripts.postinstall: node postinstall.js`, which runs automatically on `npm install`. The script is a...
OpenSSF/OSV malware advisory MAL-2026-3766 blocks this version. The package declares `scripts.postinstall: node postinstall.js`, which runs automatically on `npm install`. The script is a...
OpenSSF/OSV malware advisory MAL-2026-1804 blocks this version. The package not-remix was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-1804 blocks this version. The package not-remix was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-1804 blocks this version. The package not-remix was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6169 blocks this version. The npm package `notificationcenter-enzyme-jest` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive...
OpenSSF/OSV malware advisory MAL-2026-6071 blocks this version. OSV/OpenSSF confirms n8n-nodes-security-test-poc@1.0.5 as malicious package MAL-2026-6071. Malicious code in n8n-nodes-secu...
OpenSSF/OSV malware advisory MAL-2026-6071 blocks this version. OSV/OpenSSF confirms n8n-nodes-security-test-poc@1.0.4 as malicious package MAL-2026-6071. Malicious code in n8n-nodes-secu...
OpenSSF/OSV malware advisory MAL-2026-6071 blocks this version. OSV/OpenSSF confirms n8n-nodes-security-test-poc@1.0.3 as malicious package MAL-2026-6071. Malicious code in n8n-nodes-secu...
OpenSSF/OSV malware advisory MAL-2026-6071 blocks this version. OSV/OpenSSF confirms n8n-nodes-security-test-poc@1.0.2 as malicious package MAL-2026-6071. Malicious code in n8n-nodes-secu...
OpenSSF/OSV malware advisory MAL-2026-6071 blocks this version. OSV/OpenSSF confirms n8n-nodes-security-test-poc@1.0.1 as malicious package MAL-2026-6071. Malicious code in n8n-nodes-secu...
OpenSSF/OSV malware advisory MAL-2026-4604 blocks this version. lynx-keeper-cli ships a heavily obfuscated payload in dist/index.js that runs at require() time. After a CI-evasion gate th...
OpenSSF/OSV malware advisory MAL-2026-4604 blocks this version. lynx-keeper-cli ships a heavily obfuscated payload in dist/index.js that runs at require() time. After a CI-evasion gate th...
OpenSSF/OSV malware advisory MAL-2026-4603 blocks this version. On require, dist/index.js executes a hex-obfuscated harvester that reads ~/.aws/credentials, ~/.aws/config, ~/.ssh/id_rsa,...
OpenSSF/OSV malware advisory MAL-2026-4603 blocks this version. On require, dist/index.js executes a hex-obfuscated harvester that reads ~/.aws/credentials, ~/.aws/config, ~/.ssh/id_rsa,...
OpenSSF/OSV malware advisory MAL-2026-4603 blocks this version. On require, dist/index.js executes a hex-obfuscated harvester that reads ~/.aws/credentials, ~/.aws/config, ~/.ssh/id_rsa,...
OpenSSF/OSV malware advisory MAL-2026-4278 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4278 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4278 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...