npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 483
Updated 24 Oct 2026, 04:59 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6340 blocks this version. Package 'rainbownkit' is a single-character typosquat of the popular Web3 library 'rainbowkit'. The shipped source, README,...
OpenSSF/OSV malware advisory MAL-2026-6339 blocks this version. The package publishes as `rainbokit` but ships a verbatim copy of the legitimate `big.js` library (matching author, reposit...
OpenSSF/OSV malware advisory MAL-2026-6338 blocks this version. index.js imports child_process and invokes execSync with bash and zsh shell strings (around lines 315 and 331). The pattern...
OpenSSF/OSV malware advisory MAL-2026-6319 blocks this version. The package ships a verbatim copy of MikeMcl/big.js v7.0.1 (same banner, MIT copyright, and API) but is published under a d...
OpenSSF/OSV malware advisory MAL-2026-6319 blocks this version. The package ships a verbatim copy of MikeMcl/big.js v7.0.1 (same banner, MIT copyright, and API) but is published under a d...
OpenSSF/OSV malware advisory MAL-2026-6475 blocks this version. The package presents itself as a Tailwind CSS typography plugin (its name, description, and source tree clone @tailwindcss/...
OpenSSF/OSV malware advisory MAL-2026-6198 blocks this version. Package `new-ecro-1` impersonates the legitimate `big.js` library by shipping its source verbatim (banner, license, and hom...
OpenSSF/OSV malware advisory MAL-2026-6198 blocks this version. Package `new-ecro-1` impersonates the legitimate `big.js` library by shipping its source verbatim (banner, license, and hom...
OpenSSF/OSV malware advisory MAL-2026-6229 blocks this version. routecraft@4.2.0 ships verbatim Express.js source (lib/routecraft.js, lib/application.js, lib/request.js, lib/response.js,...
OpenSSF/OSV malware advisory MAL-2026-6187 blocks this version. Package masquerades as an ESLint utility but contains no lint-related code. The exported from_str() recursively walks proce...
OpenSSF/OSV malware advisory MAL-2026-6224 blocks this version. Package is published as 'new-eslint' but ships a verbatim copy of MikeMcl/big.js, with a hidden loader injected mid-file be...
OpenSSF/OSV malware advisory MAL-2026-6187 blocks this version. Package masquerades as an ESLint utility but contains no lint-related code. The exported from_str() recursively walks proce...
OpenSSF/OSV malware advisory MAL-2026-6143 blocks this version. On install, postinstall.js executes automatically and exfiltrates host reconnaissance data to attacker-controlled subdomain...
OpenSSF/OSV malware advisory MAL-2026-6199 blocks this version. ts-big-ecro is a verbatim copy of the legitimate big.js library (MikeMcl/big.js v7.0.1) with its name, repository field, an...
OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...
OpenSSF/OSV malware advisory MAL-2026-6477 blocks this version. lib/index.cjs and lib/index.mjs (re-required from lib/readonly.cjs) contain a self-executing IIFE that decodes two opaque s...
OpenSSF/OSV malware advisory MAL-2026-6213 blocks this version. The package advertises itself as a small in-memory pubsub library but its main entry `dist/index.js` eagerly `require()`s `...
OpenSSF/OSV malware advisory MAL-2026-6213 blocks this version. The package advertises itself as a small in-memory pubsub library but its main entry `dist/index.js` eagerly `require()`s `...
OpenSSF/OSV malware advisory MAL-2026-5973 blocks this version. The package masquerades as a Tailwind plugin: README and the top of src/index.js are a verbatim clone of @tailwindcss/typog...
OpenSSF/OSV malware advisory MAL-2026-6313 blocks this version. @zynkit/jwtbytes (malicious version 0.5.3, published by zynkit-sk393b@wshu.net) is a trojanized npm package belonging to th...
OpenSSF/OSV malware advisory MAL-2026-6312 blocks this version. @tinyfox/shapecheck (malicious version 0.8.7, published by tinyfox-yjwiqz@wshu.net) is a trojanized npm package belonging t...
OpenSSF/OSV malware advisory MAL-2026-6311 blocks this version. @thymelab/logfx (malicious version 2.15.5, published by thymelab-v0et8w@wshu.net) is a trojanized npm package belonging to...
OpenSSF/OSV malware advisory MAL-2026-6310 blocks this version. @petitcode/eb-retry (malicious version 1.3.5, published by petitcode-eq1efk@wshu.net) is a trojanized npm package belonging...
OpenSSF/OSV malware advisory MAL-2026-6309 blocks this version. @nullzero/urlcat (version 1.4.2, published by nullzero-rlnozk@wshu.net) is a trojanized npm package belonging to the wshu.n...
OpenSSF/OSV malware advisory MAL-2026-6308 blocks this version. @lazyutil/dater (malicious versions 0.8.1, 0.9.2, 0.9.3, and 0.9.4, published by lazyutil-78muyg@wshu.net) is a trojanized...