npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 456
Updated 23 Oct 2026, 12:00 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6873 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6873 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6873 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6873 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6873 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6873 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6873 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6873 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6873 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6873 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6901 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6901 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6901 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6901 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6901 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6826 blocks this version. Package name mimics the rollup-plugin-* ecosystem but exposes no Rollup plugin API. Its exported functions getPlugin, setPl...
OpenSSF/OSV malware advisory MAL-2026-6721 blocks this version. The package's index.js defines run()/from_str() that recursively walk process.cwd() and match files named.env, env, id.json...
OpenSSF/OSV malware advisory MAL-2026-5936 blocks this version. vite-config-field@1.1.0 impersonates the legitimate vite-plugin-pwa package (README copies its banner/badges, funding field...
OpenSSF/OSV malware advisory MAL-2026-5973 blocks this version. The package masquerades as a Tailwind plugin: README and the top of src/index.js are a verbatim clone of @tailwindcss/typog...
OpenSSF/OSV malware advisory MAL-2026-2350 blocks this version. Package impersonates the popular `dotenv` package: `package.json` points its repository field to `git://github.com/motdotla...
OpenSSF/OSV malware advisory MAL-2026-2350 blocks this version. Package impersonates the popular `dotenv` package: `package.json` points its repository field to `git://github.com/motdotla...
OpenSSF/OSV malware advisory MAL-2026-5743 blocks this version. index.js contains a commented-out line that, if uncommented, would base64-decode the URL https://www.jsonkeeper.com/b/VKUNI...
OpenSSF/OSV malware advisory MAL-2026-6721 blocks this version. The package's index.js defines run()/from_str() that recursively walk process.cwd() and match files named.env, env, id.json...
OpenSSF/OSV malware advisory MAL-2026-5581 blocks this version. Package impersonates the webpack ecosystem but is unrelated to webpack. When the exported middleware is invoked, index.js s...
OpenSSF/OSV malware advisory MAL-2026-6807 blocks this version. The package's index.js is heavily obfuscated with classic string-array shuffling patterns (e.g., while(!![]) loops with rep...