npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 479
Updated 24 Oct 2026, 02:13 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6273 blocks this version. The package is published under a name suggesting a Pino logger integration for Zod, but the tarball contents do not match t...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...
OpenSSF/OSV malware advisory MAL-2026-6274 blocks this version. The package advertises itself as a Web3 fee utility but its main export is a dropper. index.js line 140 base64-decodes a pl...
OpenSSF/OSV malware advisory MAL-2026-6274 blocks this version. The package advertises itself as a Web3 fee utility but its main export is a dropper. index.js line 140 base64-decodes a pl...
OpenSSF/OSV malware advisory MAL-2026-6274 blocks this version. The package advertises itself as a Web3 fee utility but its main export is a dropper. index.js line 140 base64-decodes a pl...
OpenSSF/OSV malware advisory MAL-2026-6274 blocks this version. The package advertises itself as a Web3 fee utility but its main export is a dropper. index.js line 140 base64-decodes a pl...
OpenSSF/OSV malware advisory MAL-2026-6273 blocks this version. The package is published under a name suggesting a Pino logger integration for Zod, but the tarball contents do not match t...
OpenSSF/OSV malware advisory MAL-2026-6271 blocks this version. On Windows, scripts/postinstall.js XOR-decodes a hardcoded C2 host (node22.lunes.host:3258), authenticates with a 5-minute...
OpenSSF/OSV malware advisory MAL-2026-6271 blocks this version. On Windows, scripts/postinstall.js XOR-decodes a hardcoded C2 host (node22.lunes.host:3258), authenticates with a 5-minute...
OpenSSF/OSV malware advisory MAL-2026-6440 blocks this version. The package advertises plain math/formatter helpers but index.js contains a heavily obfuscated payload concealed inside the...
OpenSSF/OSV malware advisory MAL-2026-6271 blocks this version. On Windows, scripts/postinstall.js XOR-decodes a hardcoded C2 host (node22.lunes.host:3258), authenticates with a 5-minute...
OpenSSF/OSV malware advisory MAL-2026-6368 blocks this version. The postinstall script scripts/sync-peer.cjs runs `npm pack decimal-format-utils@1.0.1` (or whatever version is configured...
OpenSSF/OSV malware advisory MAL-2026-6472 blocks this version. src/index.js appends a heavily obfuscated async IIFE after a legitimate-looking TailwindCSS plugin. On import, the IIFE iss...
OpenSSF/OSV malware advisory MAL-2026-6326 blocks this version. Package name, README, repository URL, contributors, and module structure are copied from the legitimate '@ethereumjs/util'...
OpenSSF/OSV malware advisory MAL-2026-6440 blocks this version. The package advertises plain math/formatter helpers but index.js contains a heavily obfuscated payload concealed inside the...
OpenSSF/OSV malware advisory MAL-2026-6278 blocks this version. Package is published under the name `ts-wross` but its package.json claims authorship by Michael Mclaughlin (M8ch88l@gmail....
OpenSSF/OSV malware advisory MAL-2026-6275 blocks this version. The published tarball's dist/index.js contains an obfuscated payload that runs at require() time inside a setTimeout-wrappe...
OpenSSF/OSV malware advisory MAL-2026-6275 blocks this version. The published tarball's dist/index.js contains an obfuscated payload that runs at require() time inside a setTimeout-wrappe...
OpenSSF/OSV malware advisory MAL-2026-6275 blocks this version. The published tarball's dist/index.js contains an obfuscated payload that runs at require() time inside a setTimeout-wrappe...