npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 472
Updated 23 Oct 2026, 21:27 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3397 blocks this version. The package tecken was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3387 blocks this version. The package @gaia-codesearch/gaia-api-python was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3394 blocks this version. The package @gaia-codesearch/gaia-api-typescript was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3353 blocks this version. The package money-badger-open-rpc was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3353 blocks this version. The package money-badger-open-rpc was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3351 blocks this version. The package @rivianlabs/dt-shop-bag-v0 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3350 blocks this version. The package @rivianlabs/dt-lib-lumberjack was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3349 blocks this version. The package @rivianlabs/dc-fe-app-web-rivian-com was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3348 blocks this version. The package @rivianlabs/bedrock was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3334 blocks this version. The package fanduel was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3330 blocks this version. The package seek-pass was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3329 blocks this version. The package api-typings was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3327 blocks this version. The package capacitor-plugin-service-worker was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3327 blocks this version. The package capacitor-plugin-service-worker was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3336 blocks this version. The package @channel_bot/xa0 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3335 blocks this version. The package @bank-widgets/whats-new was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3249 blocks this version. The package internal-company-module-test-1337 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3249 blocks this version. The package internal-company-module-test-1337 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3249 blocks this version. The package internal-company-module-test-1337 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3249 blocks this version. The package internal-company-module-test-1337 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3311 blocks this version. path-addon impersonates the Node.js core `path` module (package name `path-addon`, README claims to be 'an exact copy of th...
OpenSSF/OSV malware advisory MAL-2025-49456 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. a static rule a static pattern match (critical) flag...
OpenSSF/OSV malware advisory MAL-2025-49456 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. a static rule a static pattern match (critical) flag...
OpenSSF/OSV malware advisory MAL-2025-49456 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. a static rule a static pattern match (critical) flag...
OpenSSF/OSV malware advisory MAL-2025-49456 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. a static rule a static pattern match (critical) flag...