npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 505
Updated 24 Oct 2026, 16:46 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5621 blocks this version. Package name `twilio-sdk` impersonates the official Twilio Node SDK (`twilio`) but ships an empty API (`module.exports = {}...
OpenSSF/OSV malware advisory MAL-2026-5572 blocks this version. Package impersonates the official SendGrid npm packages (@sendgrid/*) but ships no SDK functionality — index.js exports an...
OpenSSF/OSV malware advisory MAL-2026-5988 blocks this version. The package presents itself as 'Simplified HTTP request client' and copies identity metadata from Mikeal Rogers' legitimate...
OpenSSF/OSV malware advisory MAL-2026-5793 blocks this version. Package masquerades as an internal Swiss Post NativeScript package (name `nativescript-swisspost-pcc-creative-editor`, desc...
OpenSSF/OSV malware advisory MAL-2026-5792 blocks this version. package.json declares `preinstall: node index.js`. On `npm install`, index.js reads `process.env.INIT_CWD` (the installing...
OpenSSF/OSV malware advisory MAL-2026-4699 blocks this version. Package metadata advertises 'utility mf' with main 'index.js', but the shipped main is a 15.7MB obfuscator.io-style blob pr...
OpenSSF/OSV malware advisory MAL-2026-4699 blocks this version. Package metadata advertises 'utility mf' with main 'index.js', but the shipped main is a 15.7MB obfuscator.io-style blob pr...
OpenSSF/OSV malware advisory MAL-2026-6305 blocks this version. @frostnode/waitfor (malicious versions 0.9.0, 0.10.3, 0.10.4, and 0.10.5, published by frostnode-gk8pbf@wshu.net) is a troj...
OpenSSF/OSV malware advisory MAL-2026-6306 blocks this version. No suspicious behaviors were detected in this package. There are no lifecycle scripts performing remote fetches, no credent...
OpenSSF/OSV malware advisory MAL-2026-6304 blocks this version. No suspicious behaviors were observed in this package version. There are no install-time lifecycle hooks fetching or execut...
OpenSSF/OSV malware advisory MAL-2026-6313 blocks this version. @zynkit/jwtbytes (malicious version 0.5.3, published by zynkit-sk393b@wshu.net) is a trojanized npm package belonging to th...
OpenSSF/OSV malware advisory MAL-2026-6314 blocks this version. No concrete indicators of installer-side harm were observed in this package version. No lifecycle scripts performing remote...
OpenSSF/OSV malware advisory MAL-2026-6312 blocks this version. @tinyfox/shapecheck (malicious version 0.8.7, published by tinyfox-yjwiqz@wshu.net) is a trojanized npm package belonging t...
OpenSSF/OSV malware advisory MAL-2026-6311 blocks this version. @thymelab/logfx (malicious version 2.15.5, published by thymelab-v0et8w@wshu.net) is a trojanized npm package belonging to...
OpenSSF/OSV malware advisory MAL-2026-6310 blocks this version. @petitcode/eb-retry (malicious version 1.3.5, published by petitcode-eq1efk@wshu.net) is a trojanized npm package belonging...
OpenSSF/OSV malware advisory MAL-2026-6309 blocks this version. @nullzero/urlcat (version 1.4.2, published by nullzero-rlnozk@wshu.net) is a trojanized npm package belonging to the wshu.n...
OpenSSF/OSV malware advisory MAL-2026-6308 blocks this version. @lazyutil/dater (malicious versions 0.8.1, 0.9.2, 0.9.3, and 0.9.4, published by lazyutil-78muyg@wshu.net) is a trojanized...
OpenSSF/OSV malware advisory MAL-2026-6307 blocks this version. @glitchpad/throttler (malicious version 2.2.3, published by glitchpad-revqgz@wshu.net) is a trojanized npm package belongin...
OpenSSF/OSV malware advisory MAL-2026-6214 blocks this version. Package advertises itself as a small hex/base64/endianness codec library, but every exported encode/decode function (encode...
OpenSSF/OSV malware advisory MAL-2026-6213 blocks this version. The package advertises itself as a small in-memory pubsub library but its main entry `dist/index.js` eagerly `require()`s `...
OpenSSF/OSV malware advisory MAL-2026-6212 blocks this version. The package advertises itself as a tiny environment-variable validator but ships lib/preflight.js, a heavily obfuscated (ob...
OpenSSF/OSV malware advisory MAL-2026-6210 blocks this version. @apexcraft/nano-key advertises itself as a 12-byte sortable ID generator (README and repository metadata are copied from yi...
OpenSSF/OSV malware advisory MAL-2026-6210 blocks this version. @apexcraft/nano-key advertises itself as a 12-byte sortable ID generator (README and repository metadata are copied from yi...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-4699 blocks this version. Package metadata advertises 'utility mf' with main 'index.js', but the shipped main is a 15.7MB obfuscator.io-style blob pr...