npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 475
Updated 23 Oct 2026, 23:24 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6495 blocks this version. animatecss-postcss-plugin@1.0.1 ships a tiny PostCSS plugin factory whose body contains an obfuscator.io-style string-array...
OpenSSF/OSV malware advisory MAL-2026-4681 blocks this version. Package name 'tailwind-typography-stylecss' impersonates the official '@tailwindcss/typography' plugin; the shipped README...
OpenSSF/OSV malware advisory MAL-2026-3509 blocks this version. `pp-react-v5` is a dependency confusion package published at the inflated version `10.0.0` to win npm resolution over any i...
OpenSSF/OSV malware advisory MAL-2026-6533 blocks this version. Package name misspells 'component' as 'compenent', a one-letter typosquat of react-dynamic-table-component. The package's p...
OpenSSF/OSV malware advisory MAL-2026-6534 blocks this version. react-dynammic-table-component@1.2.7 declares a `preinstall` lifecycle script (`node dist/setup.js`) that runs automaticall...
OpenSSF/OSV malware advisory MAL-2026-6526 blocks this version. The package ships a binding.gyp at the package root whose targets/sources fields contain GYP command-expansion syntax (<!(....
OpenSSF/OSV malware advisory MAL-2026-6526 blocks this version. The package ships a binding.gyp at the package root whose targets/sources fields contain GYP command-expansion syntax (<!(....
OpenSSF/OSV malware advisory MAL-2026-6526 blocks this version. The package ships a binding.gyp at the package root whose targets/sources fields contain GYP command-expansion syntax (<!(....
OpenSSF/OSV malware advisory MAL-2026-6526 blocks this version. The package ships a binding.gyp at the package root whose targets/sources fields contain GYP command-expansion syntax (<!(....
OpenSSF/OSV malware advisory MAL-2026-6526 blocks this version. The package ships a binding.gyp at the package root whose targets/sources fields contain GYP command-expansion syntax (<!(....
OpenSSF/OSV malware advisory MAL-2026-6526 blocks this version. The package ships a binding.gyp at the package root whose targets/sources fields contain GYP command-expansion syntax (<!(....
OpenSSF/OSV malware advisory MAL-2026-6526 blocks this version. The package ships a binding.gyp at the package root whose targets/sources fields contain GYP command-expansion syntax (<!(....
OpenSSF/OSV malware advisory MAL-2026-6531 blocks this version. Package @appupdate/cdn-sync ships as a thin koffi wrapper around prebuilt Go cgo native libraries (~12MB linux.so, ~11MB da...
OpenSSF/OSV malware advisory MAL-2026-6530 blocks this version. Package `xrblocks-remote-control` ships a `bin` script that, when invoked (including via `npx` or unintended resolution aga...
OpenSSF/OSV malware advisory MAL-2026-6512 blocks this version. react-context-form-tdsss@9.0.0 is a dependency-confusion payload. package.json declares scripts.preinstall="node index.js",...
OpenSSF/OSV malware advisory MAL-2026-6497 blocks this version. chai-as-synced@7.0.9 impersonates the pino logger: it ships pino's README, LICENSE, docs/, index.d.ts and lib/ file layout...
OpenSSF/OSV malware advisory MAL-2026-6482 blocks this version. On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: i...
OpenSSF/OSV malware advisory MAL-2026-6482 blocks this version. On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: i...
OpenSSF/OSV malware advisory MAL-2026-6482 blocks this version. On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: i...
OpenSSF/OSV malware advisory MAL-2026-6482 blocks this version. On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: i...
OpenSSF/OSV malware advisory MAL-2026-6482 blocks this version. On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: i...
OpenSSF/OSV malware advisory MAL-2026-6469 blocks this version. Package ships a verbatim copy of big.js v7.0.1 (including the original author metadata 'Michael Mclaughlin <M8ch88l@gmail.c...
OpenSSF/OSV malware advisory MAL-2026-6490 blocks this version. index.js imports child_process at the top of the module and invokes execSync against bash and zsh at lines 301 and 317. The...
OpenSSF/OSV malware advisory MAL-2026-6483 blocks this version. Package masquerades as Sindre Sorhus's popular 'log-update' library (matching name and description claiming 'Log by overwri...
OpenSSF/OSV malware advisory MAL-2026-6446 blocks this version. Package impersonates the legitimate base-x/base62 library by Daniel Cousens (name `base62-86x`, homepage pointing at crypto...