Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Updated 13 Oct 2026, 08:45 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2025-3138 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2025-4579 blocks this version. The package communicates with a domain associated with malicious activity.
OpenSSF/OSV malware advisory MAL-2025-3660 blocks this version. This package steals IP address and sent it to C&C server in preinstall hook.
OpenSSF/OSV malware advisory MAL-2025-3660 blocks this version. This package steals IP address and sent it to C&C server in preinstall hook.
OpenSSF/OSV malware advisory MAL-2025-3138 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...