npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 507
Updated 22 Oct 2026, 17:11 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-12261 blocks this version. On require of the package, index.js loads _bridge.js which assembles Cloudflare Workers hostnames by joining split string...
OpenSSF/OSV malware advisory MAL-2026-12256 blocks this version. On require() of the package, index.js loads _loader.js which downloads a platform-specific executable from Cloudflare Work...
OpenSSF/OSV malware advisory MAL-2026-12249 blocks this version. On require() of the package, _helpers.js selects a platform-specific binary path, downloads bytes from one of four hardcod...
OpenSSF/OSV malware advisory MAL-2026-12264 blocks this version. Package main entry require()'s./_adapter on load, which reconstructs Cloudflare workers.dev hostnames and a well1.site fal...
OpenSSF/OSV malware advisory MAL-2026-12233 blocks this version. On require of the package, index.js loads _bootstrap.js which reconstructs hardcoded hostnames via split-string.join obfus...
OpenSSF/OSV malware advisory MAL-2026-12296 blocks this version. On require of the package's main module, _loader.js downloads a platform-specific binary from a set of obfuscated Cloudfla...
OpenSSF/OSV malware advisory MAL-2026-12251 blocks this version. On require() of tinkoff-pfpa-tools, index.js loads _adapter.js which downloads a platform-specific native executable from...
OpenSSF/OSV malware advisory MAL-2026-12298 blocks this version. On require() of this package, index.js loads _init.js which immediately downloads a platform-specific binary from hardcode...
OpenSSF/OSV malware advisory MAL-2026-12230 blocks this version. On require of this package, index.js loads _vendor.js which detects the host OS/arch, assembles destination hostnames from...
OpenSSF/OSV malware advisory MAL-2026-12211 blocks this version. On require() of the package, index.js loads _bridge.js which detects the host platform, fetches a native binary from a rot...
OpenSSF/OSV malware advisory MAL-2026-12283 blocks this version. The package impersonates a Tinkoff UI Angular addon but ships only a stub class plus a dropper at _ext.js that is loaded v...
OpenSSF/OSV malware advisory MAL-2026-12262 blocks this version. The package's main entrypoint (index.js) unconditionally requires _bootstrap.js, which downloads a platform-specific execu...
OpenSSF/OSV malware advisory MAL-2026-12270 blocks this version. On require/import, index.js loads _bridge.js which selects a platform-specific endpoint and downloads an opaque executable...
OpenSSF/OSV malware advisory MAL-2026-12231 blocks this version. Package name typosquats Tinkoff's official SME registration form. On require() of the package, index.js loads _ext.js, whi...
OpenSSF/OSV malware advisory MAL-2026-12235 blocks this version. On require() of tinkoff-boxy-mobile-separator, index.js loads _init.js which reconstructs Cloudflare Workers hostnames by...
OpenSSF/OSV malware advisory MAL-2026-12307 blocks this version. On require() of the package, index.js exports a no-op class and unconditionally loads _bridge.js. _bridge.js reconstructs...
OpenSSF/OSV malware advisory MAL-2026-12303 blocks this version. On require of the package, index.js loads _compat.js which reconstructs Cloudflare workers.dev hostnames via split-string...
OpenSSF/OSV malware advisory MAL-2026-12027 blocks this version. tailwind-anime@1.1.0 is a typosquat of tailwindcss-animate. Its index.js appends an eval(atob('...')) blob that runs whene...
OpenSSF/OSV malware advisory MAL-2026-12027 blocks this version. tailwind-anime@1.1.0 is a typosquat of tailwindcss-animate. Its index.js appends an eval(atob('...')) blob that runs whene...
OpenSSF/OSV malware advisory MAL-2026-12222 blocks this version. dist/index.js re-exports a benign Tailwind plugin and appends an eval(atob(...)) payload that runs when the module is requ...
OpenSSF/OSV malware advisory MAL-2026-12218 blocks this version. The package publishes as 'tailwind-animation-founder' while its README, homepage, and npm badges point to a differently-na...
OpenSSF/OSV malware advisory MAL-2026-12225 blocks this version. The package advertises itself as a time-formatting utility (index.js exports formatDate/capitalize/truncate) but ships a p...
OpenSSF/OSV malware advisory MAL-2026-11108 blocks this version. The package's postinstall.js lifecycle script executes a shell pipeline via child_process.exec on npm install. The pipelin...
OpenSSF/OSV malware advisory MAL-2026-12026 blocks this version. LPM AI assessed this version as clean; the assessments disagree. The CommonJS entry src/index.cjs exports getPlugin(), whi...
OpenSSF/OSV malware advisory MAL-2026-12026 blocks this version. LPM AI assessed this version as clean; the assessments disagree. The CommonJS entry src/index.cjs exports getPlugin(), whi...