npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 522
Updated 25 Oct 2026, 03:25 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5164 blocks this version. Part of a coordinated multi-package supply-chain attack impersonating EMCD (emcd.io), a legitimate Russian cryptocurrency e...
OpenSSF/OSV malware advisory MAL-2026-5165 blocks this version. Part of a coordinated multi-package supply-chain attack impersonating EMCD (emcd.io), a legitimate Russian cryptocurrency e...
OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...
OpenSSF/OSV malware advisory MAL-2026-5752 blocks this version. package.json declares a preinstall lifecycle script that runs `wget --quiet "http://orwa-orwa.dev-node-lap.workers.dev/?use...
OpenSSF/OSV malware advisory MAL-2026-6185 blocks this version. On `npm install`, postinstall.js unconditionally reads the installer's `~/.npmrc` (which typically contains `//registry.npm...
OpenSSF/OSV malware advisory MAL-2026-5098 blocks this version. package.json declares `"postinstall": "node poc.js"`, which fires automatically on every `npm install`. poc.js reads `os.ho...
OpenSSF/OSV malware advisory MAL-2026-5087 blocks this version. buffer-utilities impersonates the legitimate `buffer` package by Feross Aboukhadijeh, copying its name, email, homepage, an...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-5730 blocks this version. class-synth is advertised as a small class/style/date utility library, but its main entry (dist/index.js) contains a hidden...
OpenSSF/OSV malware advisory MAL-2026-6484 blocks this version. The package advertises itself as a 5-line random-string generator, but index.js (the declared main) contains a hardcoded AE...
OpenSSF/OSV malware advisory MAL-2026-5753 blocks this version. Package advertises trivial form-validation helpers (notEmpty/isEmail/isPhone/maxLen/minLen) but on require/import of the ma...
OpenSSF/OSV malware advisory MAL-2026-5753 blocks this version. Package advertises trivial form-validation helpers (notEmpty/isEmail/isPhone/maxLen/minLen) but on require/import of the ma...
OpenSSF/OSV malware advisory MAL-2026-5730 blocks this version. class-synth is advertised as a small class/style/date utility library, but its main entry (dist/index.js) contains a hidden...
OpenSSF/OSV malware advisory MAL-2026-5730 blocks this version. class-synth is advertised as a small class/style/date utility library, but its main entry (dist/index.js) contains a hidden...
OpenSSF/OSV malware advisory MAL-2026-6084 blocks this version. @array-util/nodepull@1.1.1 ships a single 19 KB obfuscated index.js as its main entry. On require()/import, the IIFE silenc...
OpenSSF/OSV malware advisory MAL-2026-5730 blocks this version. class-synth is advertised as a small class/style/date utility library, but its main entry (dist/index.js) contains a hidden...
OpenSSF/OSV malware advisory MAL-2026-6085 blocks this version. @hotcappuccino/nodepull@1.0.0 ships a single `index.js` (the package's declared `main`) that is wrapped in an obfuscator.io...
OpenSSF/OSV malware advisory MAL-2026-5753 blocks this version. Package advertises trivial form-validation helpers (notEmpty/isEmail/isPhone/maxLen/minLen) but on require/import of the ma...
OpenSSF/OSV malware advisory MAL-2026-5753 blocks this version. Package advertises trivial form-validation helpers (notEmpty/isEmail/isPhone/maxLen/minLen) but on require/import of the ma...
OpenSSF/OSV malware advisory MAL-2026-5753 blocks this version. Package advertises trivial form-validation helpers (notEmpty/isEmail/isPhone/maxLen/minLen) but on require/import of the ma...
OpenSSF/OSV malware advisory MAL-2026-5753 blocks this version. Package advertises trivial form-validation helpers (notEmpty/isEmail/isPhone/maxLen/minLen) but on require/import of the ma...
OpenSSF/OSV malware advisory MAL-2026-5730 blocks this version. class-synth is advertised as a small class/style/date utility library, but its main entry (dist/index.js) contains a hidden...
OpenSSF/OSV malware advisory MAL-2026-5730 blocks this version. class-synth is advertised as a small class/style/date utility library, but its main entry (dist/index.js) contains a hidden...
OpenSSF/OSV malware advisory MAL-2026-5753 blocks this version. Package advertises trivial form-validation helpers (notEmpty/isEmail/isPhone/maxLen/minLen) but on require/import of the ma...
OpenSSF/OSV malware advisory MAL-2026-5477 blocks this version. Package squats the unscoped name `mcp-server-figma`, which AI coding agents and developers commonly invoke via `npx mcp-ser...