npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 446
Updated 23 Oct 2026, 06:52 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6394 blocks this version. Package self-identifies in package.json as a dependency-confusion proof-of-concept targeting HubSpot's internal `hs-locale-...
OpenSSF/OSV malware advisory MAL-2026-6407 blocks this version. Package is openly labeled a dependency-confusion proof-of-concept and uses a high version number (99.99.99) consistent with...
OpenSSF/OSV malware advisory MAL-2024-1006 blocks this version. @ebay/ui-core-react@9.8.1 is a scoped React UI component library published under the eBay organization scope. No indicators...
OpenSSF/OSV malware advisory MAL-2026-6204 blocks this version. No suspicious behaviors were identified in this package version. There are no lifecycle hook hazards, no outbound network c...
OpenSSF/OSV malware advisory MAL-2026-6119 blocks this version. index.js imports child_process and invokes execSync with bash and zsh shells (lines 315 and 331). Without traced reachabili...
OpenSSF/OSV malware advisory MAL-2026-6518 blocks this version. ai-node-relay ships dist/index.js as its npm main entry, processed with javascript-obfuscator (string-array rotation, _0x-p...
OpenSSF/OSV malware advisory MAL-2026-6075 blocks this version. On `npm install`, the package's postinstall hook executes `node index.js`, which collects the installer's public IP (via ap...
OpenSSF/OSV malware advisory MAL-2026-5853 blocks this version. Package contains only package.json and README.md, with the README explicitly stating it is a proof-of-concept squatting an...
OpenSSF/OSV malware advisory MAL-2024-1006 blocks this version. @ebay/ui-core-react@9.8.1 is a scoped React UI component library published under the eBay organization scope. No indicators...
OpenSSF/OSV malware advisory MAL-2026-5381 blocks this version. Package `@doaction/systeminformation` published at version 99.99.99 has a name closely matching the widely-used `systeminfo...
OpenSSF/OSV malware advisory MAL-2026-5380 blocks this version. `@doaction/sudo-prompt` shares the name of the widely-used unscoped `sudo-prompt` package but contains none of its privileg...
OpenSSF/OSV malware advisory MAL-2026-5371 blocks this version. @doaction/example@99.99.99 is a scoped npm package whose package.json self-describes as 'Example package with Datadog envir...
OpenSSF/OSV malware advisory MAL-2026-5370 blocks this version. The package is a thin shim. package.json declares `preinstall: node scripts/postinstall.js`, which require()s `@doaction/sh...
OpenSSF/OSV malware advisory MAL-2026-5351 blocks this version. **Note:** *This report is updated by a verification record*
OpenSSF/OSV malware advisory MAL-2026-5350 blocks this version. **Note:** *This report is updated by a verification record*
OpenSSF/OSV malware advisory MAL-2026-5351 blocks this version. **Note:** *This report is updated by a verification record*
OpenSSF/OSV malware advisory MAL-2026-5350 blocks this version. **Note:** *This report is updated by a verification record*
OpenSSF/OSV malware advisory MAL-2024-1006 blocks this version. @ebay/ui-core-react@9.8.1 is a scoped React UI component library published under the eBay organization scope. No indicators...
OpenSSF/OSV malware advisory MAL-2026-5381 blocks this version. Package `@doaction/systeminformation` published at version 99.99.99 has a name closely matching the widely-used `systeminfo...
OpenSSF/OSV malware advisory MAL-2026-5370 blocks this version. The package is a thin shim. package.json declares `preinstall: node scripts/postinstall.js`, which require()s `@doaction/sh...
OpenSSF/OSV malware advisory MAL-2026-6652 blocks this version. No suspicious behaviors were identified in this package version. The tarball contains 2 files with no lifecycle scripts, no...
OpenSSF/OSV malware advisory MAL-2024-1006 blocks this version. @ebay/ui-core-react@9.8.1 is a scoped React UI component library published under the eBay organization scope. No indicators...
OpenSSF/OSV malware advisory MAL-2024-1006 blocks this version. @ebay/ui-core-react@9.8.1 is a scoped React UI component library published under the eBay organization scope. No indicators...
OpenSSF/OSV malware advisory MAL-2024-1006 blocks this version. @ebay/ui-core-react@9.8.1 is a scoped React UI component library published under the eBay organization scope. No indicators...
OpenSSF/OSV malware advisory MAL-2026-6756 blocks this version. On import of dist/server/index.js, a top-level block spawns a detached shell that (1) appends a hardcoded attacker ssh-ed25...