npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 502
Updated 24 Oct 2026, 15:05 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-6457 blocks this version. The package's main entry `index.js` is the only file of substance and is wrapped in obfuscator.io string-array + RC4 obfusc...
OpenSSF/OSV malware advisory MAL-2026-6084 blocks this version. @array-util/nodepull@1.1.1 ships a single 19 KB obfuscated index.js as its main entry. On require()/import, the IIFE silenc...
OpenSSF/OSV malware advisory MAL-2026-6457 blocks this version. The package's main entry `index.js` is the only file of substance and is wrapped in obfuscator.io string-array + RC4 obfusc...
OpenSSF/OSV malware advisory MAL-2026-5491 blocks this version. The package ships scripts/script.js containing heavy obfuscation patterns (string-array shift rotation, hex-encoded numeric...
OpenSSF/OSV malware advisory MAL-2026-6183 blocks this version. preinstall.js, registered as scripts.preinstall and also required from the main module and every bin entry, collects os.hos...
OpenSSF/OSV malware advisory MAL-2026-5087 blocks this version. buffer-utilities impersonates the legitimate `buffer` package by Feross Aboukhadijeh, copying its name, email, homepage, an...
OpenSSF/OSV malware advisory MAL-2026-2929 blocks this version. On require(), path.js runs an IIFE that calls a loader which fetches a base64-hidden URL (https://www.jsonkeeper.com/b/XTTB...
OpenSSF/OSV malware advisory MAL-2026-4592 blocks this version. On require()/import of jsontoken-extend, sign.js executes a top-level IIFE that base64-decodes a hardcoded string to https:...
OpenSSF/OSV malware advisory MAL-2026-6316 blocks this version. Package is published as 'ts-biginteger-lib' but its metadata, README, and source are a wholesale copy of big.js by MikeMcl...
OpenSSF/OSV malware advisory MAL-2026-6195 blocks this version. index.js imports child_process and contains a hardcoded outbound POST to https://tg-wallet-manager.vercel.app, with additio...
OpenSSF/OSV malware advisory MAL-2026-6068 blocks this version. swift-parse-stream advertises itself as an SVG sanitizer/minifier but ships an undocumented `getPlugin` export in index.js...
OpenSSF/OSV malware advisory MAL-2026-6066 blocks this version. The package is advertised as an SVG sanitizer but exposes an undocumented getPlugin() export whose returned function fetche...
OpenSSF/OSV malware advisory MAL-2026-6066 blocks this version. The package is advertised as an SVG sanitizer but exposes an undocumented getPlugin() export whose returned function fetche...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-5861 blocks this version. bot.js performs a hardcoded HTTPS GET to api.telegram.org's bot sendMessage endpoint, transmitting host fingerprint data co...
OpenSSF/OSV malware advisory MAL-2026-5860 blocks this version. Package masquerades as a 'Drop-in replacement for @solana/web3.js' and lists its author as 'Solana Labs Maintainers <mainta...
OpenSSF/OSV malware advisory MAL-2026-5735 blocks this version. On `npm install`, this package's postinstall hook (`node index.js`) hex-encodes the installer's current working directory,...
OpenSSF/OSV malware advisory MAL-2026-2891 blocks this version. chai-as-init is a malicious npm package that when imported downloads a C2 dropper from https://api.npoint[.]io/c2e881b8bc0f...
OpenSSF/OSV malware advisory MAL-2026-6087 blocks this version. The package's only documented function, getJogos() (default export), unconditionally invokes an internal helper named prepa...
OpenSSF/OSV malware advisory MAL-2026-5291 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...