npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 469
Updated 23 Oct 2026, 19:35 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6700 blocks this version. package.json declares preinstall, install, and postinstall hooks that all invoke install.js, so the payload runs unconditio...
OpenSSF/OSV malware advisory MAL-2026-6700 blocks this version. package.json declares preinstall, install, and postinstall hooks that all invoke install.js, so the payload runs unconditio...
OpenSSF/OSV malware advisory MAL-2026-6699 blocks this version. Package wires preinstall, install, and postinstall lifecycle hooks to run postinstall.js, which executes unconditionally on...
OpenSSF/OSV malware advisory MAL-2026-6699 blocks this version. Package wires preinstall, install, and postinstall lifecycle hooks to run postinstall.js, which executes unconditionally on...
OpenSSF/OSV malware advisory MAL-2026-6699 blocks this version. Package wires preinstall, install, and postinstall lifecycle hooks to run postinstall.js, which executes unconditionally on...
OpenSSF/OSV malware advisory MAL-2026-6702 blocks this version. vue-demi-fix is a name-confusion package against the widely used vue-demi library. package.json declares both preinstall an...
OpenSSF/OSV malware advisory MAL-2026-6701 blocks this version. The package's preinstall lifecycle hook (scripts.preinstall = "node index.js") auto-executes index.js on `npm install`. The...
OpenSSF/OSV malware advisory MAL-2026-6697 blocks this version. @sudoughnym/enviro-demo@99.99.99 ships preinstall.js and postinstall.js lifecycle scripts that run automatically on `npm in...
OpenSSF/OSV malware advisory MAL-2026-6696 blocks this version. @businessapp-microsites/apis@9999.0.2 is a dependency-confusion squat against the private scope `@businessapp-microsites`,...
OpenSSF/OSV malware advisory MAL-2026-6696 blocks this version. @businessapp-microsites/apis@9999.0.2 is a dependency-confusion squat against the private scope `@businessapp-microsites`,...
OpenSSF/OSV malware advisory MAL-2026-6588 blocks this version. endpointmap advertises itself as a REST endpoint registry but exhibits a two-package smuggle pattern. lib/registry.js expor...
OpenSSF/OSV malware advisory MAL-2026-6588 blocks this version. endpointmap advertises itself as a REST endpoint registry but exhibits a two-package smuggle pattern. lib/registry.js expor...
OpenSSF/OSV malware advisory MAL-2026-6555 blocks this version. The unscoped npm package `livekit-agents` advertises itself in README as the official LiveKit Agents SDK and links to livek...
OpenSSF/OSV malware advisory MAL-2026-6572 blocks this version. The package declares a `preinstall` hook that runs `node callback.js`. On `npm install`, `callback.js` collects installer-s...
OpenSSF/OSV malware advisory MAL-2026-6573 blocks this version. Package rebrandly-domains-search-client@9999.0.0 is an empty module (index.js exports an empty object) whose package.json p...
OpenSSF/OSV malware advisory MAL-2026-6532 blocks this version. chai-as-assured impersonates the popular chai-as-promised package (matching README, author, and API surface). When the expo...
OpenSSF/OSV malware advisory MAL-2026-6555 blocks this version. The unscoped npm package `livekit-agents` advertises itself in README as the official LiveKit Agents SDK and links to livek...
OpenSSF/OSV malware advisory MAL-2026-6555 blocks this version. The unscoped npm package `livekit-agents` advertises itself in README as the official LiveKit Agents SDK and links to livek...
OpenSSF/OSV malware advisory MAL-2026-6555 blocks this version. The unscoped npm package `livekit-agents` advertises itself in README as the official LiveKit Agents SDK and links to livek...
OpenSSF/OSV malware advisory MAL-2026-6674 blocks this version. package.json declares a preinstall lifecycle hook (`node index.js`) that auto-executes on `npm install`. index.js queries t...
OpenSSF/OSV malware advisory MAL-2026-6673 blocks this version. anthropic-toolkit@0.1.1 is a typosquat against the @anthropic-ai/sdk ecosystem. The package ships no library code — its dec...
OpenSSF/OSV malware advisory MAL-2026-6673 blocks this version. anthropic-toolkit@0.1.1 is a typosquat against the @anthropic-ai/sdk ecosystem. The package ships no library code — its dec...
OpenSSF/OSV malware advisory MAL-2026-6673 blocks this version. anthropic-toolkit@0.1.1 is a typosquat against the @anthropic-ai/sdk ecosystem. The package ships no library code — its dec...
OpenSSF/OSV malware advisory MAL-2026-6673 blocks this version. anthropic-toolkit@0.1.1 is a typosquat against the @anthropic-ai/sdk ecosystem. The package ships no library code — its dec...
OpenSSF/OSV malware advisory MAL-2026-6673 blocks this version. anthropic-toolkit@0.1.1 is a typosquat against the @anthropic-ai/sdk ecosystem. The package ships no library code — its dec...