Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Updated 13 Oct 2026, 12:28 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-13366 blocks this version. package.json declares a postinstall script that spawns vendor/gridgen-linux-x64 during `npm install`. The README describes...
OpenSSF/OSV malware advisory MAL-2026-13366 blocks this version. package.json declares a postinstall script that spawns vendor/gridgen-linux-x64 during `npm install`. The README describes...
OpenSSF/OSV malware advisory MAL-2026-14039 blocks this version. Package presents itself as a CDN static-asset distribution library but ships 19 pre-compiled arm64 Mach-O binaries under 0...
OpenSSF/OSV malware advisory MAL-2026-14039 blocks this version. Package presents itself as a CDN static-asset distribution library but ships 19 pre-compiled arm64 Mach-O binaries under 0...