npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 521
Updated 24 Oct 2026, 04:07 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-11723 blocks this version. npm/@or-sdk/queue-manager is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-...
OpenSSF/OSV malware advisory MAL-2026-11738 blocks this version. npm/@or-sdk/web-search is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hul...
OpenSSF/OSV malware advisory MAL-2026-11731 blocks this version. npm/@or-sdk/tables is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud:...
OpenSSF/OSV malware advisory MAL-2026-11709 blocks this version. npm/@or-sdk/library-types-v1 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...
OpenSSF/OSV malware advisory MAL-2026-11703 blocks this version. npm/@or-sdk/key-value-storage is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "S...
OpenSSF/OSV malware advisory MAL-2026-11701 blocks this version. npm/@or-sdk/idw-skill is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulu...
OpenSSF/OSV malware advisory MAL-2026-11732 blocks this version. npm/@or-sdk/tags is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud: He...
OpenSSF/OSV malware advisory MAL-2026-11698 blocks this version. npm/@or-sdk/identifiers is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hu...
OpenSSF/OSV malware advisory MAL-2026-11686 blocks this version. npm/@or-sdk/data-hub-svc is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-H...
OpenSSF/OSV malware advisory MAL-2026-11722 blocks this version. npm/@or-sdk/qna is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud: Her...
OpenSSF/OSV malware advisory MAL-2026-11736 blocks this version. npm/@or-sdk/view-templates is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai...
OpenSSF/OSV malware advisory MAL-2026-11713 blocks this version. npm/@or-sdk/mcp-tools is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulu...
OpenSSF/OSV malware advisory MAL-2026-11685 blocks this version. npm/@or-sdk/data-hub is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud...
OpenSSF/OSV malware advisory MAL-2026-11729 blocks this version. npm/@or-sdk/step-templates is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai...
OpenSSF/OSV malware advisory MAL-2026-11734 blocks this version. npm/@or-sdk/transcripts is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hu...
OpenSSF/OSV malware advisory MAL-2026-11712 blocks this version. npm/@or-sdk/markdowner is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hul...
OpenSSF/OSV malware advisory MAL-2026-11682 blocks this version. npm/@or-sdk/chat is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud: He...
OpenSSF/OSV malware advisory MAL-2026-11714 blocks this version. npm/@or-sdk/notifications is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-...
OpenSSF/OSV malware advisory MAL-2026-11735 blocks this version. npm/@or-sdk/users is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud: H...
OpenSSF/OSV malware advisory MAL-2026-11693 blocks this version. npm/@or-sdk/files-sync-node is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sha...
OpenSSF/OSV malware advisory MAL-2026-11695 blocks this version. npm/@or-sdk/flows is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud: H...
OpenSSF/OSV malware advisory MAL-2026-11687 blocks this version. npm/@or-sdk/deployer is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud...
OpenSSF/OSV malware advisory MAL-2026-11705 blocks this version. npm/@or-sdk/knowledge-models is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...
OpenSSF/OSV malware advisory MAL-2026-11716 blocks this version. npm/@or-sdk/payments is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud...
OpenSSF/OSV malware advisory MAL-2026-11699 blocks this version. npm/@or-sdk/idw is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud: Her...