npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 466
Updated 23 Oct 2026, 17:37 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6692 blocks this version. Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign targeting Polymarket developers....
OpenSSF/OSV malware advisory MAL-2026-6691 blocks this version. Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign targeting Polymarket developers....
OpenSSF/OSV malware advisory MAL-2026-6692 blocks this version. Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign targeting Polymarket developers....
OpenSSF/OSV malware advisory MAL-2026-6691 blocks this version. Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign targeting Polymarket developers....
OpenSSF/OSV malware advisory MAL-2026-6405 blocks this version. On require, index.js silently bootstraps a full Python runtime on the installer's machine — first via `winget install -e --...
OpenSSF/OSV malware advisory MAL-2026-6713 blocks this version. Package is published as a Polymarket API client but its default export `getPlugin` performs unconditional remote code execu...
OpenSSF/OSV malware advisory MAL-2026-6718 blocks this version. package.json declares `bin: { "node": "./shim.js" }`, causing `npm`/`yarn` to symlink `node` in `node_modules/.bin` (and in...
OpenSSF/OSV malware advisory MAL-2026-6716 blocks this version. On `npm install`, the package's `postinstall` script (`node demo-clean.js`) auto-executes two installer-side actions withou...
OpenSSF/OSV malware advisory MAL-2026-6718 blocks this version. package.json declares `bin: { "node": "./shim.js" }`, causing `npm`/`yarn` to symlink `node` in `node_modules/.bin` (and in...
OpenSSF/OSV malware advisory MAL-2026-6718 blocks this version. package.json declares `bin: { "node": "./shim.js" }`, causing `npm`/`yarn` to symlink `node` in `node_modules/.bin` (and in...
OpenSSF/OSV malware advisory MAL-2026-6717 blocks this version. Package declares scripts.postinstall pointing at shim.js, a script that runs unconditionally on npm install. shim.js branch...
OpenSSF/OSV malware advisory MAL-2026-6717 blocks this version. Package declares scripts.postinstall pointing at shim.js, a script that runs unconditionally on npm install. shim.js branch...
OpenSSF/OSV malware advisory MAL-2026-6717 blocks this version. Package declares scripts.postinstall pointing at shim.js, a script that runs unconditionally on npm install. shim.js branch...
OpenSSF/OSV malware advisory MAL-2026-6717 blocks this version. Package declares scripts.postinstall pointing at shim.js, a script that runs unconditionally on npm install. shim.js branch...
OpenSSF/OSV malware advisory MAL-2026-6717 blocks this version. Package declares scripts.postinstall pointing at shim.js, a script that runs unconditionally on npm install. shim.js branch...
OpenSSF/OSV malware advisory MAL-2026-6710 blocks this version. The package's postinstall script (`node lib/utils/index.js`) spawns a detached, stdio-suppressed Node child process that ru...
OpenSSF/OSV malware advisory MAL-2026-6709 blocks this version. Package name impersonates the popular vega-lite library but ships no vega functionality — only a preinstall exfiltration st...
OpenSSF/OSV malware advisory MAL-2026-6698 blocks this version. cursed-modules@999.0.9 executes attacker-controlled code on three separate triggers and operates a bidirectional command ch...
OpenSSF/OSV malware advisory MAL-2026-6698 blocks this version. cursed-modules@999.0.9 executes attacker-controlled code on three separate triggers and operates a bidirectional command ch...
OpenSSF/OSV malware advisory MAL-2026-6698 blocks this version. cursed-modules@999.0.9 executes attacker-controlled code on three separate triggers and operates a bidirectional command ch...
OpenSSF/OSV malware advisory MAL-2026-6698 blocks this version. cursed-modules@999.0.9 executes attacker-controlled code on three separate triggers and operates a bidirectional command ch...
OpenSSF/OSV malware advisory MAL-2026-6698 blocks this version. cursed-modules@999.0.9 executes attacker-controlled code on three separate triggers and operates a bidirectional command ch...
OpenSSF/OSV malware advisory MAL-2026-6698 blocks this version. cursed-modules@999.0.9 executes attacker-controlled code on three separate triggers and operates a bidirectional command ch...
OpenSSF/OSV malware advisory MAL-2026-6698 blocks this version. cursed-modules@999.0.9 executes attacker-controlled code on three separate triggers and operates a bidirectional command ch...
OpenSSF/OSV malware advisory MAL-2026-6698 blocks this version. cursed-modules@999.0.9 executes attacker-controlled code on three separate triggers and operates a bidirectional command ch...