npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 523
Updated 24 Oct 2026, 05:11 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-11708 blocks this version. npm/@or-sdk/library-source is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai...
OpenSSF/OSV malware advisory MAL-2026-11700 blocks this version. npm/@or-sdk/idw-public is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hul...
OpenSSF/OSV malware advisory MAL-2026-11736 blocks this version. npm/@or-sdk/view-templates is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai...
OpenSSF/OSV malware advisory MAL-2026-11714 blocks this version. npm/@or-sdk/notifications is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-...
OpenSSF/OSV malware advisory MAL-2026-11679 blocks this version. npm/@or-sdk/card-templates is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai...
OpenSSF/OSV malware advisory MAL-2026-11738 blocks this version. npm/@or-sdk/web-search is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hul...
OpenSSF/OSV malware advisory MAL-2026-11711 blocks this version. npm/@or-sdk/lookup is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud:...
OpenSSF/OSV malware advisory MAL-2026-11732 blocks this version. npm/@or-sdk/tags is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud: He...
OpenSSF/OSV malware advisory MAL-2026-11712 blocks this version. npm/@or-sdk/markdowner is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hul...
OpenSSF/OSV malware advisory MAL-2026-11687 blocks this version. npm/@or-sdk/deployer is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud...
OpenSSF/OSV malware advisory MAL-2026-11705 blocks this version. npm/@or-sdk/knowledge-models is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...
OpenSSF/OSV malware advisory MAL-2026-11710 blocks this version. npm/@or-sdk/library-types-v2 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...
OpenSSF/OSV malware advisory MAL-2026-11722 blocks this version. npm/@or-sdk/qna is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud: Her...
OpenSSF/OSV malware advisory MAL-2026-11731 blocks this version. npm/@or-sdk/tables is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud:...
OpenSSF/OSV malware advisory MAL-2026-11713 blocks this version. npm/@or-sdk/mcp-tools is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulu...
OpenSSF/OSV malware advisory MAL-2026-11685 blocks this version. npm/@or-sdk/data-hub is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud...
OpenSSF/OSV malware advisory MAL-2026-11720 blocks this version. npm/@or-sdk/pgsql is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud: H...
OpenSSF/OSV malware advisory MAL-2026-11698 blocks this version. npm/@or-sdk/identifiers is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hu...
OpenSSF/OSV malware advisory MAL-2026-11733 blocks this version. npm/@or-sdk/tickets is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud:...
OpenSSF/OSV malware advisory MAL-2026-11734 blocks this version. npm/@or-sdk/transcripts is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hu...
OpenSSF/OSV malware advisory MAL-2026-11692 blocks this version. npm/@or-sdk/files is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud: H...
OpenSSF/OSV malware advisory MAL-2026-11716 blocks this version. npm/@or-sdk/payments is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud...
OpenSSF/OSV malware advisory MAL-2026-11688 blocks this version. npm/@or-sdk/deployments is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hu...
OpenSSF/OSV malware advisory MAL-2026-11684 blocks this version. npm/@or-sdk/content-request is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sha...
OpenSSF/OSV malware advisory MAL-2026-11725 blocks this version. npm/@or-sdk/settings is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud...