npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 518
Updated 25 Oct 2026, 00:42 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...
OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...
OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...
OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...
OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...
OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...
OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...
OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...
OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...
OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...
OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...
OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...
OpenSSF/OSV malware advisory MAL-2026-5163 blocks this version. Part of a coordinated multi-package supply-chain attack impersonating EMCD (emcd.io), a legitimate Russian cryptocurrency e...
OpenSSF/OSV malware advisory MAL-2026-5994 blocks this version. The package impersonates the pino logger (README titled 'chai-mocks', badges linking to pinojs/pino, module export named `p...
OpenSSF/OSV malware advisory MAL-2026-5611 blocks this version. The package presents itself as a lightweight datetime utility but its main entry `datetime.js` invokes `collect()` from `./...
OpenSSF/OSV malware advisory MAL-2026-5611 blocks this version. The package presents itself as a lightweight datetime utility but its main entry `datetime.js` invokes `collect()` from `./...
OpenSSF/OSV malware advisory MAL-2026-5741 blocks this version. package.json declares scripts.postinstall = `node postinstall.js`. On every `npm install`, postinstall.js runs `execSync('i...
OpenSSF/OSV malware advisory MAL-2026-5741 blocks this version. package.json declares scripts.postinstall = `node postinstall.js`. On every `npm install`, postinstall.js runs `execSync('i...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-5901 blocks this version. Package name is a one-edit typosquat of the widely-used chai-as-promised, but the shipped code is unrelated to chai. The ex...
OpenSSF/OSV malware advisory MAL-2026-5925 blocks this version. motion-lib@2.3.5 masquerades as a pino-style logger (exports module.exports.pino, ships proto.js/multistream.js/transport.j...
OpenSSF/OSV malware advisory MAL-2026-5606 blocks this version. chai-dec impersonates the chai/pino ecosystem (package name rides on chai; package.json keywords and exports — `module.expo...
OpenSSF/OSV malware advisory MAL-2026-5172 blocks this version. package.json declares scripts.preinstall = 'node index.js', which runs automatically on npm install. index.js collects host...
OpenSSF/OSV malware advisory MAL-2026-5734 blocks this version. node-denv presents itself as a pino-compatible logging middleware (index.js exports `module.exports.pino = middleware` and...
OpenSSF/OSV malware advisory MAL-2026-5908 blocks this version. chain-chai-test@1.3.5 advertises itself as a pino-style logger (keywords fast/logger/stream/json, exported alias module.exp...