npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 482
Updated 24 Oct 2026, 04:25 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6260 blocks this version. This package impersonates the Anthropic Claude SDK (name and description claim to be an 'Official Anthropic Claude SDK wrap...
OpenSSF/OSV malware advisory MAL-2026-6415 blocks this version. Package `anthropic-claude-latest` claims to be an 'Official Anthropic Claude SDK wrapper' but ships no Anthropic SDK code;...
OpenSSF/OSV malware advisory MAL-2026-6415 blocks this version. Package `anthropic-claude-latest` claims to be an 'Official Anthropic Claude SDK wrapper' but ships no Anthropic SDK code;...
OpenSSF/OSV malware advisory MAL-2026-6373 blocks this version. Package impersonates the Twilio Voice JS SDK namespace and ships a single exfiltration payload. package.json declares "prei...
OpenSSF/OSV malware advisory MAL-2026-6415 blocks this version. Package `anthropic-claude-latest` claims to be an 'Official Anthropic Claude SDK wrapper' but ships no Anthropic SDK code;...
OpenSSF/OSV malware advisory MAL-2026-6371 blocks this version. On `npm install`, the package's `preinstall` lifecycle hook runs `node index.js`, which collects host identity (`os.hostnam...
OpenSSF/OSV malware advisory MAL-2026-6318 blocks this version. Package masquerades as a TypeScript lint helper but ships a credential-harvesting payload in index.js. The exported from_st...
OpenSSF/OSV malware advisory MAL-2026-6256 blocks this version. @withgoogle/stitch-sdk is a scope-squatting package on npm that impersonates Google's Stitch AI design tool SDK. The attack...
OpenSSF/OSV malware advisory MAL-2026-6256 blocks this version. @withgoogle/stitch-sdk is a scope-squatting package on npm that impersonates Google's Stitch AI design tool SDK. The attack...
OpenSSF/OSV malware advisory MAL-2026-6256 blocks this version. @withgoogle/stitch-sdk is a scope-squatting package on npm that impersonates Google's Stitch AI design tool SDK. The attack...
OpenSSF/OSV malware advisory MAL-2026-6535 blocks this version. The package ships a 2.9 MB Windows PE32+ executable at bin/native/parser.node (sha256 b1aace6c70312a39ca39e6bba1d9abc6aaf9b...
OpenSSF/OSV malware advisory MAL-2026-6443 blocks this version. On every `import` / `require('agentsync-pkg')`, src/index.js line 152 resolves `bin/native/parser.node` and calls `require(...
OpenSSF/OSV malware advisory MAL-2026-6443 blocks this version. On every `import` / `require('agentsync-pkg')`, src/index.js line 152 resolves `bin/native/parser.node` and calls `require(...
OpenSSF/OSV malware advisory MAL-2026-6320 blocks this version. ts-escrow@0.1.0 is a verbatim copy of the big.js library (README, repository URL, author, version banner, and description a...
OpenSSF/OSV malware advisory MAL-2026-6274 blocks this version. The package advertises itself as a Web3 fee utility but its main export is a dropper. index.js line 140 base64-decodes a pl...
OpenSSF/OSV malware advisory MAL-2023-1111 blocks this version. package.json declares a preinstall hook ("preinstall": "node index.js") that runs automatically on npm install. index.js re...
OpenSSF/OSV malware advisory MAL-2026-6485 blocks this version. starship-timeline@1.0.1 ships no real functionality. Its package.json declares a preinstall hook (`"preinstall": "node inde...
OpenSSF/OSV malware advisory MAL-2026-6367 blocks this version. package.json declares a preinstall hook (`node index.js`) that runs automatically on `npm install`. index.js collects insta...
OpenSSF/OSV malware advisory MAL-2026-6379 blocks this version. On `npm install`, the package's preinstall hook (`package.json` declares `"preinstall": "node index.js"`) executes index.js...
OpenSSF/OSV malware advisory MAL-2026-6256 blocks this version. @withgoogle/stitch-sdk is a scope-squatting package on npm that impersonates Google's Stitch AI design tool SDK. The attack...
OpenSSF/OSV malware advisory MAL-2026-6341 blocks this version. On require(), index.js invokes _initMsgCache() at module top level. The function derives an AES-256-CBC key, IV, and cipher...
OpenSSF/OSV malware advisory MAL-2026-6345 blocks this version. Package name `thurdweb` is a one-character substitution of the popular web3 SDK `thirdweb`, but the shipped source is a cop...
OpenSSF/OSV malware advisory MAL-2026-6343 blocks this version. Package is published as `thidweb` but its README, source comments, repo URL, and author metadata all identify it as big.js...
OpenSSF/OSV malware advisory MAL-2026-6342 blocks this version. The package's name 'therdweb' is a one-character variation of the popular 'thirdweb' SDK, while its contents (README, sourc...
OpenSSF/OSV malware advisory MAL-2026-6344 blocks this version. Package name impersonates the well-known 'thirdweb' brand but ships a verbatim copy of MikeMcl's big.js arithmetic library...