npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 444
Updated 23 Oct 2026, 05:10 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2024-9443 blocks this version. package.json declares a preinstall hook ("preinstall": "node index.js") that runs index.js automatically on npm install. in...
OpenSSF/OSV malware advisory MAL-2026-6968 blocks this version. The package's postinstall hook auto-executes index.js on npm install. The script collects the installer's OS username (os.u...
OpenSSF/OSV malware advisory MAL-2026-6936 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6967 blocks this version. The package declares a postinstall hook that runs index.js on npm install. index.js collects the installer's OS username (o...
OpenSSF/OSV malware advisory MAL-2026-6941 blocks this version. Package name 'shopify-internel' is a one-character misspelling of 'shopify-internal' and appears to squat on the Shopify na...
OpenSSF/OSV malware advisory MAL-2026-6679 blocks this version. Package agent-starter-pack@0.0.1 was scanned with no a static rule matches and no behavioral findings. No lifecycle scripts...
OpenSSF/OSV malware advisory MAL-2026-6991 blocks this version. package.json declares a preinstall hook that runs index.js on `npm install`. index.js collects host and user identity data...
OpenSSF/OSV malware advisory MAL-2026-6988 blocks this version. `@vite-tab/tab` republishes Vite's codebase under a different name while impersonating the upstream project: `package.json`...
OpenSSF/OSV malware advisory MAL-2026-7002 blocks this version. The package's postinstall hook (`node index.js`) runs automatically on `npm install` and collects the installer's OS userna...
OpenSSF/OSV malware advisory MAL-2026-7004 blocks this version. On `npm install`, the package's postinstall hook executes index.js, which collects the installer's OS username (os.userInfo...
OpenSSF/OSV malware advisory MAL-2026-7001 blocks this version. The package's main entry (index.js) collects installer identity data — os.userInfo().username, process.env.INIT_CWD || proc...
OpenSSF/OSV malware advisory MAL-2026-6989 blocks this version. ag-charts-test@99.9.1 is a hollow package (empty index.js, no scripts, no documented functionality) whose sole effect on in...
OpenSSF/OSV malware advisory MAL-2026-6992 blocks this version. Package name `babel-eslint-parser-legacy` is a one-suffix confusion against the legitimate `babel-eslint-parser`. The packa...
OpenSSF/OSV malware advisory MAL-2026-6998 blocks this version. Package `higherlogic-ocfe@99.9.1` is a dependency-confusion lure targeting the Higher Logic vendor namespace. The published...
OpenSSF/OSV malware advisory MAL-2026-6993 blocks this version. Package published at version 9999.0.0 under the name `bytefaas-sdk`, the canonical dependency-confusion shape used to shado...
OpenSSF/OSV malware advisory MAL-2026-6997 blocks this version. goofy-sdk@9999.0.0 is a dependency-confusion squat: the version is inflated to 9999.0.0 to shadow an internal package of th...
OpenSSF/OSV malware advisory MAL-2026-7000 blocks this version. This package is a dependency-confusion payload published at an abnormally high version (9999.0.0) targeting an internal pac...
OpenSSF/OSV malware advisory MAL-2026-6761 blocks this version. On npm install, postinstall.js executes automatically and collects installer host identifiers (os.hostname(), os.userInfo()...
OpenSSF/OSV malware advisory MAL-2026-6761 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. On npm install, postinstall.js executes automatically...
OpenSSF/OSV malware advisory MAL-2026-6990 blocks this version. ai-gen-ai-opt-in@99.0.0 declares a postinstall hook (postinstall.js) that runs automatically on npm install. The script col...
OpenSSF/OSV malware advisory MAL-2026-6987 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package @luminarycloudinternal/lcvis-st@9999.0.2 is p...
OpenSSF/OSV malware advisory MAL-2026-6986 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package published under a scope shadowing internal Lu...
OpenSSF/OSV malware advisory MAL-2026-6994 blocks this version. On require(), index.js issues an HTTPS GET to https://www.jsonkeeper.com/b/PC5CK and passes the response's `cookie` field t...
OpenSSF/OSV malware advisory MAL-2026-6999 blocks this version. On npm install, the package's postinstall hook runs index.js, which reconstructs a remote URL (https://aone-kit.oss-cn-beij...
OpenSSF/OSV malware advisory MAL-2026-6937 blocks this version. Package ships only a package.json and a readme; there is no main entry, no bin, no scripts, no dependencies, and no executa...