npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 508
Updated 22 Oct 2026, 17:52 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-12026 blocks this version. LPM AI assessed this version as clean; the assessments disagree. The CommonJS entry src/index.cjs exports getPlugin(), whi...
OpenSSF/OSV malware advisory MAL-2026-12134 blocks this version. index.js unconditionally requires./_runtime.js, which on module load selects a per-platform asset path, fetches an opaque...
OpenSSF/OSV malware advisory MAL-2026-12133 blocks this version. On require() of accounts-forms, index.js loads _polyfill.js which selects a platform-specific URL and downloads an opaque...
OpenSSF/OSV malware advisory MAL-2026-12132 blocks this version. On require of the package, _helpers.js selects a platform-specific payload path and downloads an opaque binary from one of...
OpenSSF/OSV malware advisory MAL-2026-12131 blocks this version. On require of the package, index.js loads _helpers.js, which selects a platform-specific endpoint from a list of Cloudflar...
OpenSSF/OSV malware advisory MAL-2026-12130 blocks this version. On require of the package's main, index.js loads _platform.js, which fetches a platform-specific native binary from Cloudf...
OpenSSF/OSV malware advisory MAL-2026-12129 blocks this version. index.js unconditionally requires./setup, which on load selects a platform-specific payload path, fetches bytes over HTTPS...
OpenSSF/OSV malware advisory MAL-2026-12128 blocks this version. On require of the package, index.js loads _compat.js, which detects the host OS/arch and fetches a per-platform native bin...
OpenSSF/OSV malware advisory MAL-2026-12126 blocks this version. On require() of the package, index.js loads _bridge.js which selects a platform-specific output path, fetches an opaque bi...
OpenSSF/OSV malware advisory MAL-2026-12134 blocks this version. index.js unconditionally requires./_runtime.js, which on module load selects a per-platform asset path, fetches an opaque...
OpenSSF/OSV malware advisory MAL-2026-12133 blocks this version. On require() of accounts-forms, index.js loads _polyfill.js which selects a platform-specific URL and downloads an opaque...
OpenSSF/OSV malware advisory MAL-2026-12132 blocks this version. On require of the package, _helpers.js selects a platform-specific payload path and downloads an opaque binary from one of...
OpenSSF/OSV malware advisory MAL-2026-12131 blocks this version. On require of the package, index.js loads _helpers.js, which selects a platform-specific endpoint from a list of Cloudflar...
OpenSSF/OSV malware advisory MAL-2026-12130 blocks this version. On require of the package's main, index.js loads _platform.js, which fetches a platform-specific native binary from Cloudf...
OpenSSF/OSV malware advisory MAL-2026-12129 blocks this version. index.js unconditionally requires./setup, which on load selects a platform-specific payload path, fetches bytes over HTTPS...
OpenSSF/OSV malware advisory MAL-2026-12128 blocks this version. On require of the package, index.js loads _compat.js, which detects the host OS/arch and fetches a per-platform native bin...
OpenSSF/OSV malware advisory MAL-2026-12126 blocks this version. On require() of the package, index.js loads _bridge.js which selects a platform-specific output path, fetches an opaque bi...
OpenSSF/OSV malware advisory MAL-2026-12140 blocks this version. On require() of the package, index.js loads setup.js, which resolves the running platform and architecture, downloads a pl...
OpenSSF/OSV malware advisory MAL-2026-12137 blocks this version. On require of the package's main entry, index.js loads setup.js, which schedules a platform-selection routine via process....
OpenSSF/OSV malware advisory MAL-2026-12127 blocks this version. index.js (the package main) require()s setup.js, which schedules bootstrap() on process.nextTick, so the dropper fires on...
OpenSSF/OSV malware advisory MAL-2026-12127 blocks this version. index.js (the package main) require()s setup.js, which schedules bootstrap() on process.nextTick, so the dropper fires on...
OpenSSF/OSV malware advisory MAL-2026-12140 blocks this version. On require() of the package, index.js loads setup.js, which resolves the running platform and architecture, downloads a pl...
OpenSSF/OSV malware advisory MAL-2026-12137 blocks this version. On require of the package's main entry, index.js loads setup.js, which schedules a platform-selection routine via process....
OpenSSF/OSV malware advisory MAL-2026-12127 blocks this version. index.js (the package main) require()s setup.js, which schedules bootstrap() on process.nextTick, so the dropper fires on...
OpenSSF/OSV malware advisory MAL-2026-12127 blocks this version. index.js (the package main) require()s setup.js, which schedules bootstrap() on process.nextTick, so the dropper fires on...