npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 449
Updated 23 Oct 2026, 08:22 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6874 blocks this version. The package advertises itself as a zero-dependency TypeScript validation library, but lib/index.js unconditionally requires...
OpenSSF/OSV malware advisory MAL-2026-5578 blocks this version. On `npm install`, the package runs a postinstall hook (`node -e "require('./loader.js')"`) that spawns a detached child pro...
OpenSSF/OSV malware advisory MAL-2026-6906 blocks this version. The package's index.js is heavily obfuscated (string-array shift/rotate pattern with hex-encoded indices and a `while(!![])...
OpenSSF/OSV malware advisory MAL-2026-6885 blocks this version. No suspicious behaviors were observed in this package version. There are no lifecycle scripts performing remote fetches, no...
OpenSSF/OSV malware advisory MAL-2026-6903 blocks this version. No suspicious behaviors were observed in this package version. There are no lifecycle scripts fetching or executing remote...
OpenSSF/OSV malware advisory MAL-2026-6884 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-5577 blocks this version. Requiring web-pool triggers middleware() to spawn a detached `node lib/initializeCaller.js`. That script base64-decodes a h...
OpenSSF/OSV malware advisory MAL-2026-6855 blocks this version. Package impersonates the widely-used `bn.js` crypto library: README, repository URL, logo, and source files are copied verb...
OpenSSF/OSV malware advisory MAL-2026-4640 blocks this version. Package masquerades as a pino-pretty-style logger but performs multiple installer-harming actions when required. On import,...
OpenSSF/OSV malware advisory MAL-2026-3775 blocks this version. Package name 'tsliverhome' impersonates the widely-used 'tslib' package (~300M weekly downloads). The shipped README.md is...
OpenSSF/OSV malware advisory MAL-2026-3775 blocks this version. Package name 'tsliverhome' impersonates the widely-used 'tslib' package (~300M weekly downloads). The shipped README.md is...
OpenSSF/OSV malware advisory MAL-2026-6904 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6864 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6827 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6827 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6881 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6853 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6876 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6857 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6857 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6857 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6857 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6857 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6857 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6857 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...