npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 443
Updated 23 Oct 2026, 04:09 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6907 blocks this version. Package republishes the `chai-spies` Chai plugin source verbatim (including original author header) under the near-identica...
OpenSSF/OSV malware advisory MAL-2026-6907 blocks this version. Package republishes the `chai-spies` Chai plugin source verbatim (including original author header) under the near-identica...
OpenSSF/OSV malware advisory MAL-2026-3609 blocks this version. forge-jsxy is a malicious npm package part of the same campaign as forge-jsx. It typosquats the name by appending a 'y' and...
OpenSSF/OSV malware advisory MAL-2026-4792 blocks this version. The package is published as `react-json-chalk` but its `main` entry (`pino.js`) impersonates the pino logger (homepage `htt...
OpenSSF/OSV malware advisory MAL-2026-3609 blocks this version. forge-jsxy is a malicious npm package part of the same campaign as forge-jsx. It typosquats the name by appending a 'y' and...
OpenSSF/OSV malware advisory MAL-2026-3609 blocks this version. forge-jsxy is a malicious npm package part of the same campaign as forge-jsx. It typosquats the name by appending a 'y' and...
OpenSSF/OSV malware advisory MAL-2026-3609 blocks this version. forge-jsxy is a malicious npm package part of the same campaign as forge-jsx. It typosquats the name by appending a 'y' and...
OpenSSF/OSV malware advisory MAL-2026-3609 blocks this version. forge-jsxy is a malicious npm package part of the same campaign as forge-jsx. It typosquats the name by appending a 'y' and...
OpenSSF/OSV malware advisory MAL-2026-3609 blocks this version. forge-jsxy is a malicious npm package part of the same campaign as forge-jsx. It typosquats the name by appending a 'y' and...
OpenSSF/OSV malware advisory MAL-2026-6508 blocks this version. tw-style-utils@0.7.0 was scanned and produced no findings indicative of supply-chain attack behavior. No install-time lifec...
OpenSSF/OSV malware advisory MAL-2026-6508 blocks this version. tw-style-utils@0.7.0 was scanned and produced no findings indicative of supply-chain attack behavior. No install-time lifec...
OpenSSF/OSV malware advisory MAL-2026-4799 blocks this version. Package name `pdf-lib-enhanced` mimics the widely-used `pdf-lib` library and ships a verbatim copy of upstream's README. `p...
OpenSSF/OSV malware advisory MAL-2026-7013 blocks this version. The package's declared postinstall script reads the installer's OS username via os.userInfo().username and the machine host...
OpenSSF/OSV malware advisory MAL-2026-6948 blocks this version. The package presents itself as "Pure Node.js telemetry for RuntimeDev platform" but implements a full remote-access trojan....
OpenSSF/OSV malware advisory MAL-2026-7016 blocks this version. On `npm install`, the package's postinstall hook runs index.js, which performs an HTTPS GET to https://http-logger-producti...
OpenSSF/OSV malware advisory MAL-2026-6991 blocks this version. package.json declares a preinstall hook that runs index.js on `npm install`. index.js collects host and user identity data...
OpenSSF/OSV malware advisory MAL-2024-9443 blocks this version. package.json declares a preinstall hook ("preinstall": "node index.js") that runs index.js automatically on npm install. in...
OpenSSF/OSV malware advisory MAL-2026-7012 blocks this version. The npm package `express-mongo-limit` masquerades as an Express/MongoDB payload sanitization middleware (likely typosquatti...
OpenSSF/OSV malware advisory MAL-2026-7013 blocks this version. The package's declared postinstall script reads the installer's OS username via os.userInfo().username and the machine host...
OpenSSF/OSV malware advisory MAL-2026-7009 blocks this version. The package impersonates the `pino` logger (README badges, `module.exports.pino = middleware`) under a one-character-omissi...
OpenSSF/OSV malware advisory MAL-2026-7012 blocks this version. The npm package `express-mongo-limit` masquerades as an Express/MongoDB payload sanitization middleware (likely typosquatti...
OpenSSF/OSV malware advisory MAL-2026-7011 blocks this version. The package's preinstall hook ("node index.js") runs automatically on `npm install` and executes an exfiltration payload. i...
OpenSSF/OSV malware advisory MAL-2026-7014 blocks this version. The package's main entry (dist/index.js) re-exports createServerAdapter from./server/index.js, causing that module to evalu...
OpenSSF/OSV malware advisory MAL-2026-7010 blocks this version. crypto-promiser@1.0.1 is a typosquat of the legitimate crypto-promise package that ships a dropper in its lifecycle scripts...
OpenSSF/OSV malware advisory MAL-2026-6933 blocks this version. Analysis of this package version produced no static or behavioral findings indicating installer-side harm. No exfiltration,...