npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 519
Updated 25 Oct 2026, 01:23 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5158 blocks this version. page-info-service@99.9.1 ships an empty stub (`index.js` is `module.exports = {}`) with placeholder author/description meta...
OpenSSF/OSV malware advisory MAL-2026-5166 blocks this version. package.json declares a dependency `ltidisafe` resolved directly from a raw tarball URL on a generic Google Cloud Storage b...
OpenSSF/OSV malware advisory MAL-2026-5159 blocks this version. po-ops-local-dev@99.9.1 has no functional code of its own (index.js contains only `module.exports = {};` and there are no l...
OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...
OpenSSF/OSV malware advisory MAL-2026-5648 blocks this version. On `npm install`, the package's postinstall.js collects `os.hostname()` and `os.userInfo().username` and embeds them as que...
OpenSSF/OSV malware advisory MAL-2026-5648 blocks this version. On `npm install`, the package's postinstall.js collects `os.hostname()` and `os.userInfo().username` and embeds them as que...
OpenSSF/OSV malware advisory MAL-2026-5648 blocks this version. On `npm install`, the package's postinstall.js collects `os.hostname()` and `os.userInfo().username` and embeds them as que...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-5153 blocks this version. Package @att-ebiz/abs-components-bc@99.9.1 is an empty placeholder published to public npm under a scope (@att-ebiz) that m...
OpenSSF/OSV malware advisory MAL-2026-5884 blocks this version. On `npm install`, the `preinstall` hook (`node lib/setup.js`) runs on Windows and invokes `lib/worker.js`, which downloads...
OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...
OpenSSF/OSV malware advisory MAL-2026-5150 blocks this version. On `npm install`, the package's preinstall script (preinstall.js) collects the installer's hostname, OS username, current w...
OpenSSF/OSV malware advisory MAL-2026-6192 blocks this version. nodepathbalance54 exports a single function (`nodeaxionweb`) whose implementation is hidden inside a hand-rolled stack-base...
OpenSSF/OSV malware advisory MAL-2026-5972 blocks this version. On `npm install`, the package's postinstall lifecycle script (postinstall.js) collects installer-side host identifiers — os...
OpenSSF/OSV malware advisory MAL-2026-5900 blocks this version. Package name `chai-as-decrypted` mimics the popular `chai-as-promised`, and the README impersonates `pino` (uses pino's npm...
OpenSSF/OSV malware advisory MAL-2026-2891 blocks this version. chai-as-init is a malicious npm package that when imported downloads a C2 dropper from https://api.npoint[.]io/c2e881b8bc0f...
OpenSSF/OSV malware advisory MAL-2026-2509 blocks this version. Package collects and sends sensitive system info to a hardcoded server. The package masquerades as a LangGraph JS utility b...
OpenSSF/OSV malware advisory MAL-2026-5753 blocks this version. Package advertises trivial form-validation helpers (notEmpty/isEmail/isPhone/maxLen/minLen) but on require/import of the ma...
OpenSSF/OSV malware advisory MAL-2026-5139 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5140 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5133 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5142 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5141 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5145 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...
OpenSSF/OSV malware advisory MAL-2026-5146 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...