npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 480
Updated 24 Oct 2026, 02:56 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6275 blocks this version. The published tarball's dist/index.js contains an obfuscated payload that runs at require() time inside a setTimeout-wrappe...
OpenSSF/OSV malware advisory MAL-2026-6275 blocks this version. The published tarball's dist/index.js contains an obfuscated payload that runs at require() time inside a setTimeout-wrappe...
OpenSSF/OSV malware advisory MAL-2026-6325 blocks this version. Package name and metadata impersonate the legitimate @ethereumjs/util / ethereumjs-util packages: README is copied verbatim...
OpenSSF/OSV malware advisory MAL-2026-6365 blocks this version. Package `assertcore` impersonates the popular `chai` assertion library (ships a copy of chai source as cover; author and ho...
OpenSSF/OSV malware advisory MAL-2026-6496 blocks this version. Package `@dervix/ws` impersonates the popular `ws` WebSocket library — `package.json` copies the legitimate ws project's ho...
OpenSSF/OSV malware advisory MAL-2026-6542 blocks this version. The package republishes the upstream `treeify` library (Luke Plaster, repo notatestuser/treeify) verbatim under the unrelat...
OpenSSF/OSV malware advisory MAL-2026-6496 blocks this version. Package `@dervix/ws` impersonates the popular `ws` WebSocket library — `package.json` copies the legitimate ws project's ho...
OpenSSF/OSV malware advisory MAL-2026-6542 blocks this version. The package republishes the upstream `treeify` library (Luke Plaster, repo notatestuser/treeify) verbatim under the unrelat...
OpenSSF/OSV malware advisory MAL-2026-6309 blocks this version. @nullzero/urlcat (version 1.4.2, published by nullzero-rlnozk@wshu.net) is a trojanized npm package belonging to the wshu.n...
OpenSSF/OSV malware advisory MAL-2026-6470 blocks this version. Package name `chlklib` is a one-character deletion of the popular `chalk` package and replicates chalk's public API surface...
OpenSSF/OSV malware advisory MAL-2026-6470 blocks this version. Package name `chlklib` is a one-character deletion of the popular `chalk` package and replicates chalk's public API surface...
OpenSSF/OSV malware advisory MAL-2026-6470 blocks this version. Package name `chlklib` is a one-character deletion of the popular `chalk` package and replicates chalk's public API surface...
OpenSSF/OSV malware advisory MAL-2026-6470 blocks this version. Package name `chlklib` is a one-character deletion of the popular `chalk` package and replicates chalk's public API surface...
OpenSSF/OSV malware advisory MAL-2026-6260 blocks this version. This package impersonates the Anthropic Claude SDK (name and description claim to be an 'Official Anthropic Claude SDK wrap...
OpenSSF/OSV malware advisory MAL-2026-6260 blocks this version. This package impersonates the Anthropic Claude SDK (name and description claim to be an 'Official Anthropic Claude SDK wrap...
OpenSSF/OSV malware advisory MAL-2026-6271 blocks this version. On Windows, scripts/postinstall.js XOR-decodes a hardcoded C2 host (node22.lunes.host:3258), authenticates with a 5-minute...
OpenSSF/OSV malware advisory MAL-2026-6271 blocks this version. On Windows, scripts/postinstall.js XOR-decodes a hardcoded C2 host (node22.lunes.host:3258), authenticates with a 5-minute...
OpenSSF/OSV malware advisory MAL-2026-6271 blocks this version. On Windows, scripts/postinstall.js XOR-decodes a hardcoded C2 host (node22.lunes.host:3258), authenticates with a 5-minute...
OpenSSF/OSV malware advisory MAL-2026-6275 blocks this version. The published tarball's dist/index.js contains an obfuscated payload that runs at require() time inside a setTimeout-wrappe...
OpenSSF/OSV malware advisory MAL-2026-6271 blocks this version. On Windows, scripts/postinstall.js XOR-decodes a hardcoded C2 host (node22.lunes.host:3258), authenticates with a 5-minute...
OpenSSF/OSV malware advisory MAL-2026-6256 blocks this version. @withgoogle/stitch-sdk is a scope-squatting package on npm that impersonates Google's Stitch AI design tool SDK. The attack...
OpenSSF/OSV malware advisory MAL-2026-6341 blocks this version. On require(), index.js invokes _initMsgCache() at module top level. The function derives an AES-256-CBC key, IV, and cipher...
OpenSSF/OSV malware advisory MAL-2026-6260 blocks this version. This package impersonates the Anthropic Claude SDK (name and description claim to be an 'Official Anthropic Claude SDK wrap...
OpenSSF/OSV malware advisory MAL-2026-6260 blocks this version. This package impersonates the Anthropic Claude SDK (name and description claim to be an 'Official Anthropic Claude SDK wrap...
OpenSSF/OSV malware advisory MAL-2026-6260 blocks this version. This package impersonates the Anthropic Claude SDK (name and description claim to be an 'Official Anthropic Claude SDK wrap...