npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 726
Updated 28 Oct 2026, 06:18 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5695 blocks this version. OSV/OpenSSF confirms internallib_v984@1.0.4 as malicious package MAL-2026-5695. Malicious code in internallib_v984 (npm)
OpenSSF/OSV malware advisory MAL-2026-5695 blocks this version. OSV/OpenSSF confirms internallib_v984@1.0.3 as malicious package MAL-2026-5695. Malicious code in internallib_v984 (npm)
OpenSSF/OSV malware advisory MAL-2026-5695 blocks this version. OSV/OpenSSF confirms internallib_v984@1.0.2 as malicious package MAL-2026-5695. Malicious code in internallib_v984 (npm)
OpenSSF/OSV malware advisory MAL-2026-5695 blocks this version. OSV/OpenSSF confirms internallib_v984@1.0.1 as malicious package MAL-2026-5695. Malicious code in internallib_v984 (npm)
OpenSSF/OSV malware advisory MAL-2026-5694 blocks this version. OSV/OpenSSF confirms internallib_v856@99.0.0 as malicious package MAL-2026-5694. Malicious code in internallib_v856 (npm)
OpenSSF/OSV malware advisory MAL-2026-3261 blocks this version. Dependency confusion and typosquatting campaign by threat actor "saif777". Packages use inflated version numbers (9999.9999...
OpenSSF/OSV malware advisory MAL-2026-6164 blocks this version. The npm package `interaction-photos-infinitescroll` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a decepti...
OpenSSF/OSV malware advisory MAL-2026-6164 blocks this version. The npm package `interaction-photos-infinitescroll` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a decepti...
OpenSSF/OSV malware advisory MAL-2026-4587 blocks this version. On `npm install`, the package's `scripts.preinstall` runs poc.js which collects hostname, username, full network configurat...
OpenSSF/OSV malware advisory MAL-2026-4587 blocks this version. On `npm install`, the package's `scripts.preinstall` runs poc.js which collects hostname, username, full network configurat...
OpenSSF/OSV malware advisory MAL-2026-4587 blocks this version. On `npm install`, the package's `scripts.preinstall` runs poc.js which collects hostname, username, full network configurat...
OpenSSF/OSV malware advisory MAL-2026-4586 blocks this version. intl-ad-routing@99.0.1 is a dependency-confusion squat targeting an internal `@livingdesign/react` namespace. On `npm insta...
OpenSSF/OSV malware advisory MAL-2026-4586 blocks this version. intl-ad-routing@99.0.1 is a dependency-confusion squat targeting an internal `@livingdesign/react` namespace. On `npm insta...
OpenSSF/OSV malware advisory MAL-2026-4586 blocks this version. intl-ad-routing@99.0.1 is a dependency-confusion squat targeting an internal `@livingdesign/react` namespace. On `npm insta...
OpenSSF/OSV malware advisory MAL-2026-4838 blocks this version. The OpenSSF Package Analysis project identified 'justsaying-docs' @ 2.4.4 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-4591 blocks this version. On require, lib/writer.js (loaded via main=pino.js) collects a full snapshot of process.env, OS platform, hostname, usernam...
OpenSSF/OSV malware advisory MAL-2026-4591 blocks this version. On require, lib/writer.js (loaded via main=pino.js) collects a full snapshot of process.env, OS platform, hostname, usernam...
OpenSSF/OSV malware advisory MAL-2026-4591 blocks this version. On require, lib/writer.js (loaded via main=pino.js) collects a full snapshot of process.env, OS platform, hostname, usernam...
OpenSSF/OSV malware advisory MAL-2026-4590 blocks this version. The package contains a poc.js script that collects host reconnaissance data (os.hostname(), os.platform(), output of `whoam...
OpenSSF/OSV malware advisory MAL-2026-5912 blocks this version. OSV/OpenSSF confirms js-digest@4.2.2 as malicious package MAL-2026-5912. Malicious code in js-digest (npm)
OpenSSF/OSV malware advisory MAL-2026-6503 blocks this version. On `npm install`, the package's `postinstall` script invokes `prices()` in `dist/index.js`, which resolves the consumer's p...
OpenSSF/OSV malware advisory MAL-2026-6093 blocks this version. On require('jwtmode'), decode.js immediately invokes getThirdCookie(), which performs an HTTP GET to https://jsonkeeper.com...
OpenSSF/OSV malware advisory MAL-2026-4141 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4141 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-6166 blocks this version. The npm package `jest-macos` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Native compone...