npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 468
Updated 23 Oct 2026, 18:54 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6708 blocks this version. zyncmap@0.0.0 advertises itself as an SVG sanitization/minification utility, but index.js exports an undocumented function...
OpenSSF/OSV malware advisory MAL-2026-6708 blocks this version. zyncmap@0.0.0 advertises itself as an SVG sanitization/minification utility, but index.js exports an undocumented function...
OpenSSF/OSV malware advisory MAL-2026-6445 blocks this version. The package advertises itself as a Base58 encoder/decoder but on require() schedules a delayed payload that performs multip...
OpenSSF/OSV malware advisory MAL-2026-6445 blocks this version. The package advertises itself as a Base58 encoder/decoder but on require() schedules a delayed payload that performs multip...
OpenSSF/OSV malware advisory MAL-2026-6707 blocks this version. index.js exports an undocumented getPlugin() function which, when invoked, performs an HTTP GET to https://shorturl.at/147u...
OpenSSF/OSV malware advisory MAL-2026-6707 blocks this version. index.js exports an undocumented getPlugin() function which, when invoked, performs an HTTP GET to https://shorturl.at/147u...
OpenSSF/OSV malware advisory MAL-2026-6707 blocks this version. index.js exports an undocumented getPlugin() function which, when invoked, performs an HTTP GET to https://shorturl.at/147u...
OpenSSF/OSV malware advisory MAL-2026-6703 blocks this version. The OpenSSF Package Analysis project identified '@andes-tools/colors' @ 999.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-6707 blocks this version. index.js exports an undocumented getPlugin() function which, when invoked, performs an HTTP GET to https://shorturl.at/147u...
OpenSSF/OSV malware advisory MAL-2026-6707 blocks this version. index.js exports an undocumented getPlugin() function which, when invoked, performs an HTTP GET to https://shorturl.at/147u...
OpenSSF/OSV malware advisory MAL-2026-6704 blocks this version. Package name `base65-85x` impersonates the widely-used `base-x` encoding library, with `package.json` copying base-x's `hom...
OpenSSF/OSV malware advisory MAL-2026-6714 blocks this version. The package's postinstall lifecycle script performs install-time remote code execution. It reads a bundle URL from a JSON c...
OpenSSF/OSV malware advisory MAL-2026-10115 blocks this version. The npm package `fmt-date-lite` is a supply-chain dropper disguised as a benign date-formatting utility (its `description`...
OpenSSF/OSV malware advisory MAL-2026-7017 blocks this version. The npm package `logger-daemon-regex` is a full-spectrum information stealer and remote-control agent disguised as a "Node....
OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...
OpenSSF/OSV malware advisory MAL-2026-3509 blocks this version. `pp-react-v5` is a dependency confusion package published at the inflated version `10.0.0` to win npm resolution over any i...
OpenSSF/OSV malware advisory MAL-2026-6445 blocks this version. The package advertises itself as a Base58 encoder/decoder but on require() schedules a delayed payload that performs multip...
OpenSSF/OSV malware advisory MAL-2026-6445 blocks this version. The package advertises itself as a Base58 encoder/decoder but on require() schedules a delayed payload that performs multip...
OpenSSF/OSV malware advisory MAL-2026-6698 blocks this version. cursed-modules@999.0.9 executes attacker-controlled code on three separate triggers and operates a bidirectional command ch...
OpenSSF/OSV malware advisory MAL-2026-6689 blocks this version. Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. `decimal-format-core` uses a dro...
OpenSSF/OSV malware advisory MAL-2026-6698 blocks this version. cursed-modules@999.0.9 executes attacker-controlled code on three separate triggers and operates a bidirectional command ch...
OpenSSF/OSV malware advisory MAL-2026-6698 blocks this version. cursed-modules@999.0.9 executes attacker-controlled code on three separate triggers and operates a bidirectional command ch...
OpenSSF/OSV malware advisory MAL-2026-6698 blocks this version. cursed-modules@999.0.9 executes attacker-controlled code on three separate triggers and operates a bidirectional command ch...
OpenSSF/OSV malware advisory MAL-2026-6698 blocks this version. cursed-modules@999.0.9 executes attacker-controlled code on three separate triggers and operates a bidirectional command ch...
OpenSSF/OSV malware advisory MAL-2026-6698 blocks this version. cursed-modules@999.0.9 executes attacker-controlled code on three separate triggers and operates a bidirectional command ch...