npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 512
Updated 23 Oct 2026, 21:42 UTC. Ordered by latest scan.
This is a concrete import-time remote payload execution chain, not legitimate package-aligned telemetry. The absence of lifecycle hooks does not mitigate execution on normal package use.
This is a concrete import-time staged-payload execution chain unrelated to the package’s stated interface. Absence of an npm lifecycle hook does not mitigate execution on normal module im...
The remote payload is not package-aligned application functionality and is executed automatically on import, making this a concrete arbitrary-code execution chain.
OpenSSF/OSV malware advisory MAL-2026-12332 blocks this version. The package's fesm2022 ESM entry (declared as `module` in package.json and executed on `import` of the library) ends with...
OpenSSF/OSV malware advisory MAL-2026-12333 blocks this version. The package's main module contains a top-level block that runs on every require/import. It uses unicode-escape obfuscation...
OpenSSF/OSV malware advisory MAL-2026-12318 blocks this version. build/index.js appends an eval(atob(...)) block after the normal __exportStar section that decodes to an import-time loade...
OpenSSF/OSV malware advisory MAL-2026-12328 blocks this version. build/index.js appends an eval(atob(...)) blob to the legitimate common-library exports, so the payload runs whenever any...
OpenSSF/OSV malware advisory MAL-2026-12324 blocks this version. build/index.js (the package main) appends a hidden eval(atob('...')) block after the legitimate __exportStar boilerplate,...
OpenSSF/OSV malware advisory MAL-2026-12334 blocks this version. The npm package ach-detail@99.0.1 ships a preinstall lifecycle script (scripts/preinstall.js) that runs automatically on `...
OpenSSF/OSV malware advisory MAL-2026-12320 blocks this version. The npm postinstall script (bin/memorax-code-plugin-postinstall.mjs) unconditionally calls enableInternalDataCollectionCon...
OpenSSF/OSV malware advisory MAL-2026-12320 blocks this version. The npm postinstall script (bin/memorax-code-plugin-postinstall.mjs) unconditionally calls enableInternalDataCollectionCon...
OpenSSF/OSV malware advisory MAL-2026-12336 blocks this version. On require() of the package, index.js loads setup.js which invokes lib/telemetry.js's runtime.run with a list of obfuscate...
OpenSSF/OSV malware advisory MAL-2026-12336 blocks this version. On require() of the package, index.js loads setup.js which invokes lib/telemetry.js's runtime.run with a list of obfuscate...
OpenSSF/OSV malware advisory MAL-2026-12336 blocks this version. On require() of the package, index.js loads setup.js which invokes lib/telemetry.js's runtime.run with a list of obfuscate...
OpenSSF/OSV malware advisory MAL-2026-12335 blocks this version. The package's declared postinstall hook runs `node src/test.js`, which issues an HTTPS GET to https://workconfig.vercel.ap...
OpenSSF/OSV malware advisory MAL-2026-12337 blocks this version. The package presents itself as an Akamai sensor generator but ships two coupled malicious mechanisms. index.js contains a...
OpenSSF/OSV malware advisory MAL-2026-12339 blocks this version. Package is published under the name async-mutex-hook and self-describes as a Promise-based mutex library, but ships no mut...
OpenSSF/OSV malware advisory MAL-2026-12331 blocks this version. The package advertises itself as a tiny ID generator but its main entry dist/index.cjs contains an obfuscator.io + RC4 str...
OpenSSF/OSV malware advisory MAL-2026-12331 blocks this version. The package advertises itself as a tiny ID generator but its main entry dist/index.cjs contains an obfuscator.io + RC4 str...
OpenSSF/OSV malware advisory MAL-2026-12331 blocks this version. The package advertises itself as a tiny ID generator but its main entry dist/index.cjs contains an obfuscator.io + RC4 str...
OpenSSF/OSV malware advisory MAL-2026-12319 blocks this version. package.json declares preinstall and postinstall lifecycle scripts that fire automatically on npm install. The preinstall...
OpenSSF/OSV malware advisory MAL-2026-12316 blocks this version. On npm install, the package runs dist/recon.js as a postinstall script that collects the installer's hostname, username, S...
OpenSSF/OSV malware advisory MAL-2026-12316 blocks this version. On npm install, the package runs dist/recon.js as a postinstall script that collects the installer's hostname, username, S...
OpenSSF/OSV malware advisory MAL-2026-12316 blocks this version. On npm install, the package runs dist/recon.js as a postinstall script that collects the installer's hostname, username, S...
OpenSSF/OSV malware advisory MAL-2026-12317 blocks this version. package.json declares a postinstall script `node dist/recon.js || true` that runs automatically on npm install. dist/recon...