npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 465
Updated 23 Oct 2026, 16:59 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6722 blocks this version. date-fns-lite@1.0.10 presents as a lightweight date-formatting utility but ships a malicious postinstall.js that runs autom...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6722 blocks this version. date-fns-lite@1.0.10 presents as a lightweight date-formatting utility but ships a malicious postinstall.js that runs autom...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...
OpenSSF/OSV malware advisory MAL-2026-6690 blocks this version. Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. `log-taker1` embeds a full infos...
OpenSSF/OSV malware advisory MAL-2026-6715 blocks this version. src/index.cjs exports getPlugin(), which returns a function that performs an HTTPS GET to a hardcoded URL 'https://api.avax...
OpenSSF/OSV malware advisory MAL-2026-6715 blocks this version. src/index.cjs exports getPlugin(), which returns a function that performs an HTTPS GET to a hardcoded URL 'https://api.avax...
OpenSSF/OSV malware advisory MAL-2026-6715 blocks this version. src/index.cjs exports getPlugin(), which returns a function that performs an HTTPS GET to a hardcoded URL 'https://api.avax...
OpenSSF/OSV malware advisory MAL-2026-6721 blocks this version. The package's index.js defines run()/from_str() that recursively walk process.cwd() and match files named.env, env, id.json...
OpenSSF/OSV malware advisory MAL-2026-6346 blocks this version. package.json declares `preinstall: node index.js`, so the payload runs automatically on `npm install` with no user action....
OpenSSF/OSV malware advisory MAL-2026-6712 blocks this version. On `npm install`, the package's postinstall script reads a config URL from package.json's `homepage` field (https://parket-...
OpenSSF/OSV malware advisory MAL-2026-6716 blocks this version. On `npm install`, the package's `postinstall` script (`node demo-clean.js`) auto-executes two installer-side actions withou...