npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 501
Updated 24 Oct 2026, 14:32 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3288 blocks this version. Malicious npm package published by user `shetty123` as part of a Telegram account hijacking framework targeting Indian Tele...
OpenSSF/OSV malware advisory MAL-2026-6223 blocks this version. The package is published as 'mjs-eslint' but its description, file layout (big.js, big.mjs), and source are a verbatim copy...
OpenSSF/OSV malware advisory MAL-2026-5847 blocks this version. On import, the package's middleware spawns a detached `node lib/caller.js` child process. `caller.js` decodes a base64-obfu...
OpenSSF/OSV malware advisory MAL-2026-5623 blocks this version. No suspicious code, lifecycle scripts, network destinations, credential reads, or obfuscation were observed in this package...
OpenSSF/OSV malware advisory MAL-2026-5624 blocks this version. On `npm install`, postinstall.js reads the installer's `.env` file from INIT_CWD, harvests environment variable values (DEM...
OpenSSF/OSV malware advisory MAL-2026-5624 blocks this version. On `npm install`, postinstall.js reads the installer's `.env` file from INIT_CWD, harvests environment variable values (DEM...
OpenSSF/OSV malware advisory MAL-2026-5624 blocks this version. On `npm install`, postinstall.js reads the installer's `.env` file from INIT_CWD, harvests environment variable values (DEM...
OpenSSF/OSV malware advisory MAL-2026-5619 blocks this version. tailwind-typography-plus@2.1.0 impersonates the legitimate @tailwindcss/typography Tailwind CSS plugin (confusable name, co...
OpenSSF/OSV malware advisory MAL-2026-5618 blocks this version. The package's main entry src/index.js appends, after a large whitespace gap following the legitimate-looking Tailwind plugi...
OpenSSF/OSV malware advisory MAL-2026-5790 blocks this version. ldpbootstrap-jquery ships and executes an obfuscated Windows PowerShell payload as part of its documented usage. The packag...
OpenSSF/OSV malware advisory MAL-2026-5790 blocks this version. ldpbootstrap-jquery ships and executes an obfuscated Windows PowerShell payload as part of its documented usage. The packag...
OpenSSF/OSV malware advisory MAL-2026-5790 blocks this version. ldpbootstrap-jquery ships and executes an obfuscated Windows PowerShell payload as part of its documented usage. The packag...
OpenSSF/OSV malware advisory MAL-2026-5790 blocks this version. ldpbootstrap-jquery ships and executes an obfuscated Windows PowerShell payload as part of its documented usage. The packag...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-5566 blocks this version. fastify-addon is a typosquat of the legitimate fastify-plugin package. Its package.json sets repository, bugs, and homepage...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-5727 blocks this version. package.json declares a postinstall hook `node -e "require('./loader.js')"` that auto-executes on every `npm install`. load...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...