npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 493
Updated 24 Oct 2026, 10:13 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-6543 blocks this version. package.json declares `"postinstall": "node index.js"`, so `npm install express-initial` automatically runs the package's m...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-6084 blocks this version. @array-util/nodepull@1.1.1 ships a single 19 KB obfuscated index.js as its main entry. On require()/import, the IIFE silenc...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5732 blocks this version. The package presents itself as a 'simple date formatting utility' (index.js exports a trivial formatDate wrapper around toL...
OpenSSF/OSV malware advisory MAL-2026-5731 blocks this version. Package advertises itself as 'a simple date formatting utility' but ships an SSH-key-stealing C2 client. postinstall.js enu...
OpenSSF/OSV malware advisory MAL-2026-3288 blocks this version. Malicious npm package published by user `shetty123` as part of a Telegram account hijacking framework targeting Indian Tele...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...