npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 445
Updated 23 Oct 2026, 06:19 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6934 blocks this version. Package name resembles the Nuxt ecosystem's helper naming ('load-nuxt') and is published at version 99.0.3, a version-numbe...
OpenSSF/OSV malware advisory MAL-2026-6935 blocks this version. The package name resembles the legitimate Nuxt ecosystem tooling (e.g., @nuxt/load-nuxt), and the version 99.0.3 is a commo...
OpenSSF/OSV malware advisory MAL-2026-6942 blocks this version. Package some-theme@99.0.3 was scanned across 2 files with no a static rule matches and no behavioral findings. No install-t...
OpenSSF/OSV malware advisory MAL-2026-6988 blocks this version. `@vite-tab/tab` republishes Vite's codebase under a different name while impersonating the upstream project: `package.json`...
OpenSSF/OSV malware advisory MAL-2026-6562 blocks this version. Package targets the private @epic-common scope (Epic Games) and is published to the public npm registry as a dependency-con...
OpenSSF/OSV malware advisory MAL-2026-6562 blocks this version. Package targets the private @epic-common scope (Epic Games) and is published to the public npm registry as a dependency-con...
OpenSSF/OSV malware advisory MAL-2026-6683 blocks this version. No a static rule matches and no traced behavior of concern were identified in this package version. No evidence of credenti...
OpenSSF/OSV malware advisory MAL-2026-6684 blocks this version. postcss-property-rollup@0.0.1 was scanned with no a static rule matches and no behavioral findings. No exfiltration, instal...
OpenSSF/OSV malware advisory MAL-2026-6682 blocks this version. Analysis of this package version produced no static indicator and no traced behavioral findings. The tarball does not exhib...
OpenSSF/OSV malware advisory MAL-2026-6686 blocks this version. Package setup-cicd@0.0.1 contains no observed behaviors matching supply-chain attack patterns. No lifecycle scripts, instal...
OpenSSF/OSV malware advisory MAL-2026-6562 blocks this version. Package targets the private @epic-common scope (Epic Games) and is published to the public npm registry as a dependency-con...
OpenSSF/OSV malware advisory MAL-2026-6940 blocks this version. No a static rule matches and no behavioral findings were produced for this package version. There is no evidence of credent...
OpenSSF/OSV malware advisory MAL-2026-6550 blocks this version. Package claims the @k18n npm scope (used internally by Kuaishou) and publishes at version 99.0.0 — the canonical high-versi...
OpenSSF/OSV malware advisory MAL-2026-6550 blocks this version. Package claims the @k18n npm scope (used internally by Kuaishou) and publishes at version 99.0.0 — the canonical high-versi...
OpenSSF/OSV malware advisory MAL-2026-6550 blocks this version. Package claims the @k18n npm scope (used internally by Kuaishou) and publishes at version 99.0.0 — the canonical high-versi...
OpenSSF/OSV malware advisory MAL-2026-6996 blocks this version. package.json declares a preinstall script that runs `npm install @sentry/node && node examples/verify.js`. examples/verify....
OpenSSF/OSV malware advisory MAL-2024-1006 blocks this version. @ebay/ui-core-react@9.8.1 is a scoped React UI component library published under the eBay organization scope. No indicators...
OpenSSF/OSV malware advisory MAL-2026-6413 blocks this version. Package contains no observed installer-side harmful behavior. No exfiltration, no install-time fetch-and-execute, no silent...
OpenSSF/OSV malware advisory MAL-2026-6517 blocks this version. All published JavaScript in dist/ (index.js, client.js, server.js, react.js, and sibling chunks) is heavily obfuscated usin...
OpenSSF/OSV malware advisory MAL-2026-6410 blocks this version. Package self-identifies as a dependency-confusion bug-bounty proof-of-concept and is published at version 99.99.99 to win r...
OpenSSF/OSV malware advisory MAL-2026-6408 blocks this version. Package self-identifies as a HubSpot dependency-confusion proof-of-concept and is published at version 99.99.99 — a typical...
OpenSSF/OSV malware advisory MAL-2026-6396 blocks this version. signup-embedder@99.99.99-poc2 ships preinstall.js and postinstall.js lifecycle scripts that auto-execute on `npm install`....
OpenSSF/OSV malware advisory MAL-2026-6412 blocks this version. Package self-describes as a security PoC for dependency confusion targeting an internal HubSpot module name. On install, po...
OpenSSF/OSV malware advisory MAL-2026-6411 blocks this version. Package self-identifies in its package.json description as a bug-bounty dependency-confusion proof-of-concept against an in...
OpenSSF/OSV malware advisory MAL-2026-6414 blocks this version. Package self-identifies as a dependency-confusion proof-of-concept aimed at an internal/private package name. The postinsta...