npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 499
Updated 24 Oct 2026, 13:27 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5678 blocks this version. index.js implements a multi-step attack against an internal npm registry. On invocation of the exported command(), it: (1)...
OpenSSF/OSV malware advisory MAL-2026-5678 blocks this version. index.js implements a multi-step attack against an internal npm registry. On invocation of the exported command(), it: (1)...
OpenSSF/OSV malware advisory MAL-2026-5980 blocks this version. The package advertises itself as a PostCSS plugin for CSS hardware-acceleration hints, but its only legitimate behavior is...
OpenSSF/OSV malware advisory MAL-2026-5678 blocks this version. index.js implements a multi-step attack against an internal npm registry. On invocation of the exported command(), it: (1)...
OpenSSF/OSV malware advisory MAL-2026-5678 blocks this version. index.js implements a multi-step attack against an internal npm registry. On invocation of the exported command(), it: (1)...
OpenSSF/OSV malware advisory MAL-2026-5980 blocks this version. The package advertises itself as a PostCSS plugin for CSS hardware-acceleration hints, but its only legitimate behavior is...
OpenSSF/OSV malware advisory MAL-2026-5678 blocks this version. index.js implements a multi-step attack against an internal npm registry. On invocation of the exported command(), it: (1)...
OpenSSF/OSV malware advisory MAL-2026-5678 blocks this version. index.js implements a multi-step attack against an internal npm registry. On invocation of the exported command(), it: (1)...
OpenSSF/OSV malware advisory MAL-2026-5678 blocks this version. index.js implements a multi-step attack against an internal npm registry. On invocation of the exported command(), it: (1)...
OpenSSF/OSV malware advisory MAL-2026-5791 blocks this version. On require('mddriver'), an IIFE in index.js invokes loadTokenData(), which fetches https://www.jsonkeeper.com/b/C4H0M (stor...
OpenSSF/OSV malware advisory MAL-2026-5791 blocks this version. On require('mddriver'), an IIFE in index.js invokes loadTokenData(), which fetches https://www.jsonkeeper.com/b/C4H0M (stor...
OpenSSF/OSV malware advisory MAL-2026-5980 blocks this version. The package advertises itself as a PostCSS plugin for CSS hardware-acceleration hints, but its only legitimate behavior is...
OpenSSF/OSV malware advisory MAL-2026-5791 blocks this version. On require('mddriver'), an IIFE in index.js invokes loadTokenData(), which fetches https://www.jsonkeeper.com/b/C4H0M (stor...
OpenSSF/OSV malware advisory MAL-2026-5712 blocks this version. On `npm install`, the package's postinstall hook (`postinstall.js`) requires `index.js`, whose top-level `scanAndExfiltrate...
OpenSSF/OSV malware advisory MAL-2026-5677 blocks this version. package.json declares `"postinstall": "node main.js"`, so installation of worker-build@9.0.1 unconditionally executes main....
OpenSSF/OSV malware advisory MAL-2026-5988 blocks this version. The package presents itself as 'Simplified HTTP request client' and copies identity metadata from Mikeal Rogers' legitimate...
OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...
OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...
OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...
OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...
OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...
OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...
OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...
OpenSSF/OSV malware advisory MAL-2026-5710 blocks this version. package.json declares postinstall=`node lib/utils/index.js`, which spawns a detached child process running lib/utils/smtp-c...
OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...