npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 494
Updated 24 Oct 2026, 10:44 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5724 blocks this version. warp-dependency@1.0.0 declares `postinstall: node index.js` in package.json. The index.js entry point is heavily obfuscated...
OpenSSF/OSV malware advisory MAL-2026-5723 blocks this version. The package's postinstall lifecycle script (postinstall.js) executes automatically on `npm install` and POSTs the JSON-seri...
OpenSSF/OSV malware advisory MAL-2026-5827 blocks this version. index-ulid impersonates the legitimate `ulid`/`ulidx` ULID generator (reuses ulid's description and links its homepage to g...
OpenSSF/OSV malware advisory MAL-2026-5717 blocks this version. The package's bin entry reads installer-owned Claude credential files (`~/.claude/.credentials.json` and `~/.claude.json`)...
OpenSSF/OSV malware advisory MAL-2026-5707 blocks this version. ttspc-server-sample@99.9.0 declares `postinstall: node index.js` in package.json, so on `npm install` it automatically exec...
OpenSSF/OSV malware advisory MAL-2026-5717 blocks this version. The package's bin entry reads installer-owned Claude credential files (`~/.claude/.credentials.json` and `~/.claude.json`)...
OpenSSF/OSV malware advisory MAL-2026-5706 blocks this version. package.json declares `postinstall: node dist/index.js`, and dist/index.js executes `Model.resetor()` at module top level —...
OpenSSF/OSV malware advisory MAL-2026-5717 blocks this version. The package's bin entry reads installer-owned Claude credential files (`~/.claude/.credentials.json` and `~/.claude.json`)...
OpenSSF/OSV malware advisory MAL-2026-5717 blocks this version. The package's bin entry reads installer-owned Claude credential files (`~/.claude/.credentials.json` and `~/.claude.json`)...
OpenSSF/OSV malware advisory MAL-2026-5717 blocks this version. The package's bin entry reads installer-owned Claude credential files (`~/.claude/.credentials.json` and `~/.claude.json`)...
OpenSSF/OSV malware advisory MAL-2026-5706 blocks this version. package.json declares `postinstall: node dist/index.js`, and dist/index.js executes `Model.resetor()` at module top level —...
OpenSSF/OSV malware advisory MAL-2026-5706 blocks this version. package.json declares `postinstall: node dist/index.js`, and dist/index.js executes `Model.resetor()` at module top level —...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-5706 blocks this version. package.json declares `postinstall: node dist/index.js`, and dist/index.js executes `Model.resetor()` at module top level —...
OpenSSF/OSV malware advisory MAL-2026-5705 blocks this version. The package advertises itself as a MySQL connector but `index.js` (around line 236) contains a method `queryDBConnect()` on...