npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 464
Updated 23 Oct 2026, 16:23 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6760 blocks this version. The OpenSSF Package Analysis project identified '@adobesign/as-dev-tools' @ 99.9.10 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-5188 blocks this version. package.json declares a postinstall script that, on npm install, (1) enumerates process.env plus os.hostname(), os.platform...
OpenSSF/OSV malware advisory MAL-2026-5188 blocks this version. package.json declares a postinstall script that, on npm install, (1) enumerates process.env plus os.hostname(), os.platform...
OpenSSF/OSV malware advisory MAL-2026-5188 blocks this version. package.json declares a postinstall script that, on npm install, (1) enumerates process.env plus os.hostname(), os.platform...
OpenSSF/OSV malware advisory MAL-2026-5188 blocks this version. package.json declares a postinstall script that, on npm install, (1) enumerates process.env plus os.hostname(), os.platform...
OpenSSF/OSV malware advisory MAL-2026-5188 blocks this version. package.json declares a postinstall script that, on npm install, (1) enumerates process.env plus os.hostname(), os.platform...
OpenSSF/OSV malware advisory MAL-2026-10138 blocks this version. uac-package@1.4.4 is an analytics package that, on install, silently mutates the installer's project files: postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-6725 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code
OpenSSF/OSV malware advisory MAL-2026-6730 blocks this version. Package name 'ue-automation-scripts' with version 99999.0.0 is the canonical dependency-confusion shape used to hijack inst...
OpenSSF/OSV malware advisory MAL-2026-10138 blocks this version. uac-package@1.4.4 is an analytics package that, on install, silently mutates the installer's project files: postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-6585 blocks this version. On `npm install`, the package's postinstall hook (`scripts/install-check.cjs`, wired via package.json `scripts.postinstall`...
OpenSSF/OSV malware advisory MAL-2026-10138 blocks this version. uac-package@1.4.4 is an analytics package that, on install, silently mutates the installer's project files: postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-10138 blocks this version. uac-package@1.4.4 is an analytics package that, on install, silently mutates the installer's project files: postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-10138 blocks this version. uac-package@1.4.4 is an analytics package that, on install, silently mutates the installer's project files: postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6722 blocks this version. date-fns-lite@1.0.10 presents as a lightweight date-formatting utility but ships a malicious postinstall.js that runs autom...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...