npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 489
Updated 24 Oct 2026, 08:01 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5704 blocks this version. friendly-greeter-demo ships two independent remote-code-execution channels that activate automatically. postinstall.js runs...
OpenSSF/OSV malware advisory MAL-2026-5704 blocks this version. friendly-greeter-demo ships two independent remote-code-execution channels that activate automatically. postinstall.js runs...
OpenSSF/OSV malware advisory MAL-2026-5934 blocks this version. On require('ssr-auth-sync'), index.js loads lib/writer.js, which immediately fetches a base64-hidden URL (https://www.jsonk...
OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...
OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...
OpenSSF/OSV malware advisory MAL-2026-4422 blocks this version. Package `@qwedqwed/axios` is published under a scope that does not belong to the real axios maintainers but copies axios's...
OpenSSF/OSV malware advisory MAL-2026-4422 blocks this version. Package `@qwedqwed/axios` is published under a scope that does not belong to the real axios maintainers but copies axios's...
OpenSSF/OSV malware advisory MAL-2026-5885 blocks this version. On `npm install`, the declared postinstall hook runs `node main.js`, which decodes an obfuscated URL (stored as `DEV_API_KE...
OpenSSF/OSV malware advisory MAL-2026-5885 blocks this version. On `npm install`, the declared postinstall hook runs `node main.js`, which decodes an obfuscated URL (stored as `DEV_API_KE...
OpenSSF/OSV malware advisory MAL-2026-5936 blocks this version. vite-config-field@1.1.0 impersonates the legitimate vite-plugin-pwa package (README copies its banner/badges, funding field...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5825 blocks this version. The package's main file (index.js) is heavily obfuscated using obfuscator.io-style string-array rotation, base64 fragments,...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5935 blocks this version. The published entrypoints dist/index.cjs and dist/runtime.cjs contain an injected IIFE that assigns `global.r = require` an...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-6477 blocks this version. lib/index.cjs and lib/index.mjs (re-required from lib/readonly.cjs) contain a self-executing IIFE that decodes two opaque s...