npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 721
Updated 28 Oct 2026, 03:03 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4278 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4278 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4278 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4278 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4278 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-6430 blocks this version. The `leo-sdk` npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On J...
OpenSSF/OSV malware advisory MAL-2026-6431 blocks this version. The `leo-streams` npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem....
OpenSSF/OSV malware advisory MAL-2026-6429 blocks this version. The `leo-logger` npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. O...
OpenSSF/OSV malware advisory MAL-2026-6428 blocks this version. The `leo-cron` npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On...
OpenSSF/OSV malware advisory MAL-2026-6422 blocks this version. The `leo-config` npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. O...
OpenSSF/OSV malware advisory MAL-2026-6427 blocks this version. The `leo-connector-redshift` npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm...
OpenSSF/OSV malware advisory MAL-2026-6426 blocks this version. The `leo-connector-oracle` npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ec...
OpenSSF/OSV malware advisory MAL-2026-6425 blocks this version. The `leo-connector-mysql` npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm eco...
OpenSSF/OSV malware advisory MAL-2026-6424 blocks this version. The `leo-connector-mongo` npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm eco...
OpenSSF/OSV malware advisory MAL-2026-6423 blocks this version. The `leo-connector-elasticsearch` npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform...
OpenSSF/OSV malware advisory MAL-2026-6421 blocks this version. The `leo-cli` npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On J...
OpenSSF/OSV malware advisory MAL-2026-6420 blocks this version. The `leo-cdk-lib` npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem....
OpenSSF/OSV malware advisory MAL-2026-6419 blocks this version. The `leo-cache` npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On...
OpenSSF/OSV malware advisory MAL-2026-6418 blocks this version. The `leo-aws` npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On J...
OpenSSF/OSV malware advisory MAL-2026-6417 blocks this version. The `leo-auth` npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On...
OpenSSF/OSV malware advisory MAL-2026-6377 blocks this version. On require(), index.js performs a Linux platform check, then decodes a base64-obfuscated URL (https://api.ingress-hub.com/c...
OpenSSF/OSV malware advisory MAL-2026-4145 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4145 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4144 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4144 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...