npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 727
Updated 28 Oct 2026, 06:46 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6166 blocks this version. The npm package `jest-macos` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Native compone...
OpenSSF/OSV malware advisory MAL-2026-4140 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4140 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4139 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4139 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4138 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4138 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4137 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4137 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4137 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4136 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4136 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4136 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4142 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4142 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-5614 blocks this version. OSV/OpenSSF confirms janus-erc20@1.0.0 as malicious package MAL-2026-5614. Malicious code in janus-erc20 (npm)
OpenSSF/OSV malware advisory MAL-2026-5557 blocks this version. OSV/OpenSSF confirms janus-ft@1.0.0 as malicious package MAL-2026-5557. Malicious code in janus-ft (npm)
OpenSSF/OSV malware advisory MAL-2026-5556 blocks this version. OSV/OpenSSF confirms janus-flow@1.0.0 as malicious package MAL-2026-5556. Malicious code in janus-flow (npm)
OpenSSF/OSV malware advisory MAL-2026-5193 blocks this version. This malicious package is part the IronWorm campaign. This campaign executes a malicious binary payload during installation...
OpenSSF/OSV malware advisory MAL-2026-3765 blocks this version. The package declares a postinstall hook (`"postinstall": "node postinstall.js"` in package.json) that runs unconditionally...
OpenSSF/OSV malware advisory MAL-2026-3765 blocks this version. The package declares a postinstall hook (`"postinstall": "node postinstall.js"` in package.json) that runs unconditionally...
OpenSSF/OSV malware advisory MAL-2026-3765 blocks this version. The package declares a postinstall hook (`"postinstall": "node postinstall.js"` in package.json) that runs unconditionally...
OpenSSF/OSV malware advisory MAL-2026-6337 blocks this version. preinstall.js executes a chain of eval(Buffer.from('<base64>','base64').toString()) payloads at npm install time. The decod...
OpenSSF/OSV malware advisory MAL-2026-4580 blocks this version. package.json declares `"preinstall": "bun run index.js"`, which on `npm install` invokes Bun to run index.js. index.js dete...
OpenSSF/OSV malware advisory MAL-2026-4580 blocks this version. package.json declares `"preinstall": "bun run index.js"`, which on `npm install` invokes Bun to run index.js. index.js dete...