Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Updated 17 Oct 2026, 11:08 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-14121 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2025-47009 blocks this version. @magda/semantic-indexer-sdk ships a minified `dist/index.js` bundle for a Magda semantic-indexer SDK. Static keyword patte...
OpenSSF/OSV malware advisory MAL-2026-14122 blocks this version. index.js unconditionally requires./_perf.js on load. _perf.js reads ~/.sui/sui.keystore, ~/.sui/sui_config/*.yaml, ~/.aws/...
OpenSSF/OSV malware advisory MAL-2025-47009 blocks this version. @magda/semantic-indexer-sdk ships a minified `dist/index.js` bundle for a Magda semantic-indexer SDK. Static keyword patte...