Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Updated 12 Oct 2026, 18:26 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-14379 blocks this version. Package advertises itself as a TOTP utility but its postinstall script (`node./index.js --setup 2>/dev/null || true`) and...
OpenSSF/OSV malware advisory MAL-2026-12418 blocks this version. src/normalize-options.js is heavily obfuscated (RC4-decoded string array, hex-numeric literals, rotating string-array shuf...
OpenSSF/OSV malware advisory MAL-2026-10516 blocks this version. On npm install, the package's postinstall hook runs install-check.cjs, which fetches a JSON config from https://jipred.ver...
OpenSSF/OSV malware advisory MAL-2026-10160 blocks this version. On require of the main entry `dist/index.js`, the module decodes a base64 literal to the shell command `npm install vector...