npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 724
Updated 28 Oct 2026, 05:13 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4625 blocks this version. The package's documented `oh-langfuse setup` command defaults LANGFUSE_BASEURL to the bare-IP plaintext endpoint http://120...
OpenSSF/OSV malware advisory MAL-2026-4625 blocks this version. The package's documented `oh-langfuse setup` command defaults LANGFUSE_BASEURL to the bare-IP plaintext endpoint http://120...
OpenSSF/OSV malware advisory MAL-2026-4625 blocks this version. The package's documented `oh-langfuse setup` command defaults LANGFUSE_BASEURL to the bare-IP plaintext endpoint http://120...
OpenSSF/OSV malware advisory MAL-2026-4625 blocks this version. The package's documented `oh-langfuse setup` command defaults LANGFUSE_BASEURL to the bare-IP plaintext endpoint http://120...
OpenSSF/OSV malware advisory MAL-2026-4625 blocks this version. The package's documented `oh-langfuse setup` command defaults LANGFUSE_BASEURL to the bare-IP plaintext endpoint http://120...
OpenSSF/OSV malware advisory MAL-2026-4625 blocks this version. The package's documented `oh-langfuse setup` command defaults LANGFUSE_BASEURL to the bare-IP plaintext endpoint http://120...
OpenSSF/OSV malware advisory MAL-2026-4625 blocks this version. The package's documented `oh-langfuse setup` command defaults LANGFUSE_BASEURL to the bare-IP plaintext endpoint http://120...
OpenSSF/OSV malware advisory MAL-2026-4625 blocks this version. The package's documented `oh-langfuse setup` command defaults LANGFUSE_BASEURL to the bare-IP plaintext endpoint http://120...
OpenSSF/OSV malware advisory MAL-2026-4625 blocks this version. The package's documented `oh-langfuse setup` command defaults LANGFUSE_BASEURL to the bare-IP plaintext endpoint http://120...
OpenSSF/OSV malware advisory MAL-2024-2779 blocks this version. package.json declares a `preinstall: node index.js` hook that fires automatically on `npm install`. index.js collects insta...
OpenSSF/OSV malware advisory MAL-2024-2779 blocks this version. package.json declares a `preinstall: node index.js` hook that fires automatically on `npm install`. index.js collects insta...
OpenSSF/OSV malware advisory MAL-2026-5745 blocks this version. OSV/OpenSSF confirms oa-crm-webapi@9.9.99 as malicious package MAL-2026-5745. Malicious code in oa-crm-webapi (npm)
OpenSSF/OSV malware advisory MAL-2026-5828 blocks this version. OSV/OpenSSF confirms ogd-platform@1.0.0 as malicious package MAL-2026-5828. Malicious code in ogd-platform (npm)
OpenSSF/OSV malware advisory MAL-2026-5987 blocks this version. OSV/OpenSSF confirms ogd-analytics@1.0.0 as malicious package MAL-2026-5987. Malicious code in ogd-analytics (npm)
OpenSSF/OSV malware advisory MAL-2026-4149 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4149 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-3421 blocks this version. The package oneblk-design-system was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6170 blocks this version. The npm package `onesignal-hooks` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Native co...
OpenSSF/OSV malware advisory MAL-2026-6170 blocks this version. The npm package `onesignal-hooks` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Native co...
OpenSSF/OSV malware advisory MAL-2026-6258 blocks this version. onboarding-respects-modal is a dependency confusion proof-of-concept package published to the public npm registry by the ac...
OpenSSF/OSV malware advisory MAL-2026-4192 blocks this version. On `npm install`, both preinstall and postinstall lifecycle hooks execute index.js, which collects the installer's hostname...
OpenSSF/OSV malware advisory MAL-2026-4589 blocks this version. The package contains callback.js which collects host identifiers and user information (os.hostname(), os.userInfo(), os.pla...
OpenSSF/OSV malware advisory MAL-2026-4581 blocks this version. The package ships shared/keys.json containing 9 AES-256-GCM-encrypted Groq API keys. The decryption key is a fixed byte seq...
OpenSSF/OSV malware advisory MAL-2026-4581 blocks this version. The package ships shared/keys.json containing 9 AES-256-GCM-encrypted Groq API keys. The decryption key is a fixed byte seq...
OpenSSF/OSV malware advisory MAL-2026-4581 blocks this version. The package ships shared/keys.json containing 9 AES-256-GCM-encrypted Groq API keys. The decryption key is a fixed byte seq...