npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 509
Updated 23 Oct 2026, 19:52 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-12462 blocks this version. index.mjs runs a hex-obfuscated top-level async IIFE at module import time. Identifiers and payload constants (`process`,...
OpenSSF/OSV malware advisory MAL-2026-12457 blocks this version. streak-bucket-core@1.0.0 advertises itself as a small dependency-free calendar/day-math helper library, but its declared m...
OpenSSF/OSV malware advisory MAL-2026-12464 blocks this version. streak-daybucket@1.0.0 presents itself as a day-bucket / streak math utility but its index.mjs embeds a hex-encoded Window...
OpenSSF/OSV malware advisory MAL-2026-12481 blocks this version. On require, index.js schedules a delayed HTTPS POST that transmits the full process.env object along with os.hostname(), o...
OpenSSF/OSV malware advisory MAL-2026-12481 blocks this version. On require, index.js schedules a delayed HTTPS POST that transmits the full process.env object along with os.hostname(), o...
OpenSSF/OSV malware advisory MAL-2026-12431 blocks this version. index.js schedules a top-level POST on module load to https://enjbyg3xk8l.x.pipedream.net/beacon carrying the entire proce...
OpenSSF/OSV malware advisory MAL-2026-12495 blocks this version. The package presents itself as a viem wallet extension but its exported WalletKit constructor captures the caller-supplied...
OpenSSF/OSV malware advisory MAL-2026-12490 blocks this version. The package presents itself as a Uniswap V4 SDK but its WalletClient constructor captures the caller-supplied private key...
OpenSSF/OSV malware advisory MAL-2026-12498 blocks this version. The package impersonates the wagmi/viem wallet API surface (exporting createWalletClient, parseAccount, and a WalletClient...
OpenSSF/OSV malware advisory MAL-2026-12494 blocks this version. ventrix-kit@1.5.2 ships a loader that, when the package's default `getPlugin` export is invoked, performs an HTTP request...
OpenSSF/OSV malware advisory MAL-2026-10989 blocks this version. package.json declares scripts.preinstall as `node./dist/index.d.js`, which runs automatically on `npm install`. dist/index...
OpenSSF/OSV malware advisory MAL-2026-12422 blocks this version. quorvex@0.2.1 ships index.mjs as the package main, containing a base64-encoded Windows PE (~355KB) in a PAYLOAD constant....
OpenSSF/OSV malware advisory MAL-2026-12484 blocks this version. The package's declared main entry launcher.js invokes launch() at top level, so require('trailserver') triggers system-lev...
OpenSSF/OSV malware advisory MAL-2026-12312 blocks this version. Package installs a long-running daemon that opens a persistent WebSocket to wss://agenthub-agent.fyenet.com and dispatches...
OpenSSF/OSV malware advisory MAL-2026-12312 blocks this version. Package installs a long-running daemon that opens a persistent WebSocket to wss://agenthub-agent.fyenet.com and dispatches...
OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...
OpenSSF/OSV malware advisory MAL-2026-12313 blocks this version. The package ships a prebuilt darwin/x64 Mach-O binary containing a Go agent (module github.com/ccfly/rescue) that, when ex...
OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...
OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...
OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...
OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...
OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...
OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...
OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...
OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...