npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 525
Updated 24 Oct 2026, 06:08 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-11728 blocks this version. npm/@or-sdk/source-api is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hul...
OpenSSF/OSV malware advisory MAL-2026-11737 blocks this version. npm/@or-sdk/views is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud: H...
OpenSSF/OSV malware advisory MAL-2026-11706 blocks this version. npm/@or-sdk/library is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud:...
OpenSSF/OSV malware advisory MAL-2026-11729 blocks this version. npm/@or-sdk/step-templates is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai...
OpenSSF/OSV malware advisory MAL-2026-11715 blocks this version. npm/@or-sdk/password is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud...
OpenSSF/OSV malware advisory MAL-2026-11693 blocks this version. npm/@or-sdk/files-sync-node is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sha...
OpenSSF/OSV malware advisory MAL-2026-11717 blocks this version. npm/@or-sdk/permissions is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hu...
OpenSSF/OSV malware advisory MAL-2026-11704 blocks this version. npm/@or-sdk/keys is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud: He...
OpenSSF/OSV malware advisory MAL-2026-11702 blocks this version. npm/@or-sdk/invitations is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hu...
OpenSSF/OSV malware advisory MAL-2026-11733 blocks this version. npm/@or-sdk/tickets is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud:...
OpenSSF/OSV malware advisory MAL-2026-11704 blocks this version. npm/@or-sdk/keys is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud: He...
OpenSSF/OSV malware advisory MAL-2026-11688 blocks this version. npm/@or-sdk/deployments is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hu...
OpenSSF/OSV malware advisory MAL-2026-11684 blocks this version. npm/@or-sdk/content-request is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sha...
OpenSSF/OSV malware advisory MAL-2026-11719 blocks this version. npm/@or-sdk/permissions-lambda is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "...
OpenSSF/OSV malware advisory MAL-2026-11729 blocks this version. npm/@or-sdk/step-templates is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai...
OpenSSF/OSV malware advisory MAL-2026-11737 blocks this version. npm/@or-sdk/views is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud: H...
OpenSSF/OSV malware advisory MAL-2026-11707 blocks this version. npm/@or-sdk/library-categories is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "...
OpenSSF/OSV malware advisory MAL-2026-11725 blocks this version. npm/@or-sdk/settings is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud...
OpenSSF/OSV malware advisory MAL-2026-11717 blocks this version. npm/@or-sdk/permissions is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hu...
OpenSSF/OSV malware advisory MAL-2026-11727 blocks this version. npm/@or-sdk/source is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud:...
OpenSSF/OSV malware advisory MAL-2026-11731 blocks this version. npm/@or-sdk/tables is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud:...
OpenSSF/OSV malware advisory MAL-2026-11682 blocks this version. npm/@or-sdk/chat is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud: He...
OpenSSF/OSV malware advisory MAL-2026-11716 blocks this version. npm/@or-sdk/payments is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud...
OpenSSF/OSV malware advisory MAL-2026-11726 blocks this version. npm/@or-sdk/sku-builder is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hu...
OpenSSF/OSV malware advisory MAL-2026-11715 blocks this version. npm/@or-sdk/password is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud...