npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 477
Updated 24 Oct 2026, 00:48 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6404 blocks this version. Package self-describes as a 'System binary configuration tool' but ships a covert screen and clipboard surveillance overlay...
OpenSSF/OSV malware advisory MAL-2026-6404 blocks this version. Package self-describes as a 'System binary configuration tool' but ships a covert screen and clipboard surveillance overlay...
OpenSSF/OSV malware advisory MAL-2026-6437 blocks this version. On npm install, scripts/install-check.cjs (registered as a postinstall lifecycle script) fetches a JSON config from a hardc...
OpenSSF/OSV malware advisory MAL-2026-6396 blocks this version. signup-embedder@99.99.99-poc2 ships preinstall.js and postinstall.js lifecycle scripts that auto-execute on `npm install`....
OpenSSF/OSV malware advisory MAL-2026-6394 blocks this version. Package self-identifies in package.json as a dependency-confusion proof-of-concept targeting HubSpot's internal `hs-locale-...
OpenSSF/OSV malware advisory MAL-2026-2509 blocks this version. Package collects and sends sensitive system info to a hardcoded server. The package masquerades as a LangGraph JS utility b...
OpenSSF/OSV malware advisory MAL-2026-6438 blocks this version. The package ships a `postinstall` hook (`scripts/sync-peer.cjs`) that runs on every default `npm install`. The script compa...
OpenSSF/OSV malware advisory MAL-2026-6473 blocks this version. Package presents itself as a minimal React color-picker but ships a postinstall hook (`"postinstall": "node setup.js"`) tha...
OpenSSF/OSV malware advisory MAL-2026-6473 blocks this version. Package presents itself as a minimal React color-picker but ships a postinstall hook (`"postinstall": "node setup.js"`) tha...
OpenSSF/OSV malware advisory MAL-2026-6369 blocks this version. Package impersonates the well-known eth-gas-reporter / hardhat-gas-reporter packages: README is titled 'eth-test-log', copi...
OpenSSF/OSV malware advisory MAL-2026-6273 blocks this version. The package is published under a name suggesting a Pino logger integration for Zod, but the tarball contents do not match t...
OpenSSF/OSV malware advisory MAL-2026-6438 blocks this version. The package ships a `postinstall` hook (`scripts/sync-peer.cjs`) that runs on every default `npm install`. The script compa...
OpenSSF/OSV malware advisory MAL-2026-6406 blocks this version. Package is published under the cover story 'System binary configuration tool' but its actual behavior is a Windows surveill...
OpenSSF/OSV malware advisory MAL-2026-6374 blocks this version. Package declares `"bin": {"node": "./shim.js"}` in package.json, which registers `shim.js` as the `node` command in `node_m...
OpenSSF/OSV malware advisory MAL-2026-6374 blocks this version. Package declares `"bin": {"node": "./shim.js"}` in package.json, which registers `shim.js` as the `node` command in `node_m...
OpenSSF/OSV malware advisory MAL-2026-6273 blocks this version. The package is published under a name suggesting a Pino logger integration for Zod, but the tarball contents do not match t...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...