npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 500
Updated 24 Oct 2026, 13:59 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...
OpenSSF/OSV malware advisory MAL-2026-4508 blocks this version. The package contains code in dist/entry.js and dist/index.js that invokes `npm publish` programmatically combined with `wri...
OpenSSF/OSV malware advisory MAL-2026-5688 blocks this version. On `npm install`, postinstall.js executes unconditionally and performs three installer-harming actions. (1) It enumerates e...
OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...
OpenSSF/OSV malware advisory MAL-2026-5704 blocks this version. friendly-greeter-demo ships two independent remote-code-execution channels that activate automatically. postinstall.js runs...
OpenSSF/OSV malware advisory MAL-2026-5704 blocks this version. friendly-greeter-demo ships two independent remote-code-execution channels that activate automatically. postinstall.js runs...
OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...
OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...
OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...
OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...
OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...
OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...
OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...
OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...
OpenSSF/OSV malware advisory MAL-2026-5704 blocks this version. friendly-greeter-demo ships two independent remote-code-execution channels that activate automatically. postinstall.js runs...
OpenSSF/OSV malware advisory MAL-2026-5696 blocks this version. package.json declares both preinstall and postinstall lifecycle hooks that execute callback.js on `npm install`. callback.j...
OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...
OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...
OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...
OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...
OpenSSF/OSV malware advisory MAL-2026-5688 blocks this version. On `npm install`, postinstall.js executes unconditionally and performs three installer-harming actions. (1) It enumerates e...
OpenSSF/OSV malware advisory MAL-2026-5688 blocks this version. On `npm install`, postinstall.js executes unconditionally and performs three installer-harming actions. (1) It enumerates e...
OpenSSF/OSV malware advisory MAL-2026-5688 blocks this version. On `npm install`, postinstall.js executes unconditionally and performs three installer-harming actions. (1) It enumerates e...
OpenSSF/OSV malware advisory MAL-2026-5688 blocks this version. On `npm install`, postinstall.js executes unconditionally and performs three installer-harming actions. (1) It enumerates e...
OpenSSF/OSV malware advisory MAL-2026-5688 blocks this version. On `npm install`, postinstall.js executes unconditionally and performs three installer-harming actions. (1) It enumerates e...