npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 461
Updated 23 Oct 2026, 14:24 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6575 blocks this version. Package @ibrahim1337/baksen ships a Windows x64 infostealer toolkit that targets Chromium-family browsers (Chrome, Brave, E...
OpenSSF/OSV malware advisory MAL-2026-6575 blocks this version. Package @ibrahim1337/baksen ships a Windows x64 infostealer toolkit that targets Chromium-family browsers (Chrome, Brave, E...
OpenSSF/OSV malware advisory MAL-2026-6575 blocks this version. Package @ibrahim1337/baksen ships a Windows x64 infostealer toolkit that targets Chromium-family browsers (Chrome, Brave, E...
OpenSSF/OSV malware advisory MAL-2026-6575 blocks this version. Package @ibrahim1337/baksen ships a Windows x64 infostealer toolkit that targets Chromium-family browsers (Chrome, Brave, E...
OpenSSF/OSV malware advisory MAL-2026-6575 blocks this version. Package @ibrahim1337/baksen ships a Windows x64 infostealer toolkit that targets Chromium-family browsers (Chrome, Brave, E...
OpenSSF/OSV malware advisory MAL-2026-6575 blocks this version. Package @ibrahim1337/baksen ships a Windows x64 infostealer toolkit that targets Chromium-family browsers (Chrome, Brave, E...
OpenSSF/OSV malware advisory MAL-2026-6793 blocks this version. neon-terminal advertises itself as an ANSI color helper but its CJS entry (dist/index.cjs) and ESM entry (src/index.js) eac...
OpenSSF/OSV malware advisory MAL-2026-6793 blocks this version. neon-terminal advertises itself as an ANSI color helper but its CJS entry (dist/index.cjs) and ESM entry (src/index.js) eac...
OpenSSF/OSV malware advisory MAL-2026-6793 blocks this version. neon-terminal advertises itself as an ANSI color helper but its CJS entry (dist/index.cjs) and ESM entry (src/index.js) eac...
OpenSSF/OSV malware advisory MAL-2026-6793 blocks this version. neon-terminal advertises itself as an ANSI color helper but its CJS entry (dist/index.cjs) and ESM entry (src/index.js) eac...
OpenSSF/OSV malware advisory MAL-2026-6793 blocks this version. neon-terminal advertises itself as an ANSI color helper but its CJS entry (dist/index.cjs) and ESM entry (src/index.js) eac...
OpenSSF/OSV malware advisory MAL-2026-6793 blocks this version. neon-terminal advertises itself as an ANSI color helper but its CJS entry (dist/index.cjs) and ESM entry (src/index.js) eac...
OpenSSF/OSV malware advisory MAL-2026-6575 blocks this version. Package @ibrahim1337/baksen ships a Windows x64 infostealer toolkit that targets Chromium-family browsers (Chrome, Brave, E...
OpenSSF/OSV malware advisory MAL-2026-6575 blocks this version. Package @ibrahim1337/baksen ships a Windows x64 infostealer toolkit that targets Chromium-family browsers (Chrome, Brave, E...
OpenSSF/OSV malware advisory MAL-2026-6575 blocks this version. Package @ibrahim1337/baksen ships a Windows x64 infostealer toolkit that targets Chromium-family browsers (Chrome, Brave, E...
OpenSSF/OSV malware advisory MAL-2026-6575 blocks this version. Package @ibrahim1337/baksen ships a Windows x64 infostealer toolkit that targets Chromium-family browsers (Chrome, Brave, E...
OpenSSF/OSV malware advisory MAL-2026-4789 blocks this version. Package presents itself as the legitimate slopus/happy CLI (README instructs `npm install -g happy`; homepage, repository,...
OpenSSF/OSV malware advisory MAL-2026-4789 blocks this version. Package presents itself as the legitimate slopus/happy CLI (README instructs `npm install -g happy`; homepage, repository,...
OpenSSF/OSV malware advisory MAL-2025-47047 blocks this version. The package @self-sell/store was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2025-47046 blocks this version. The package @self-sell/self-sell-amplitude-events was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2025-47045 blocks this version. The package @self-sell/guards was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2025-47051 blocks this version. The package @team-event/v2 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2025-47048 blocks this version. The package @team-event/models was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2025-47033 blocks this version. The package @liquid-web/common was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2025-47040 blocks this version. The package @liquid-web/utils was found to contain malicious code.