npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 525
Updated 25 Oct 2026, 05:26 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4792 blocks this version. The package is published as `react-json-chalk` but its `main` entry (`pino.js`) impersonates the pino logger (homepage `htt...
OpenSSF/OSV malware advisory MAL-2026-2891 blocks this version. chai-as-init is a malicious npm package that when imported downloads a C2 dropper from https://api.npoint[.]io/c2e881b8bc0f...
OpenSSF/OSV malware advisory MAL-2026-5713 blocks this version. On module load, this Vite plugin performs an HTTP GET to https://www.jsonkeeper.com/b/XVHGD (an anonymous, mutable paste ho...
OpenSSF/OSV malware advisory MAL-2026-5534 blocks this version. The package ships a `postinstall` lifecycle script (`sec_check.js`) that fires automatically on `npm install`. The script f...
OpenSSF/OSV malware advisory MAL-2026-5534 blocks this version. The package ships a `postinstall` lifecycle script (`sec_check.js`) that fires automatically on `npm install`. The script f...
OpenSSF/OSV malware advisory MAL-2026-5534 blocks this version. The package ships a `postinstall` lifecycle script (`sec_check.js`) that fires automatically on `npm install`. The script f...
OpenSSF/OSV malware advisory MAL-2026-5534 blocks this version. The package ships a `postinstall` lifecycle script (`sec_check.js`) that fires automatically on `npm install`. The script f...
OpenSSF/OSV malware advisory MAL-2026-6121 blocks this version. The package's main module index.js (also loaded indirectly by bin/cli.js) reads a hidden binary file lib/.perf.dat, AES-256...
OpenSSF/OSV malware advisory MAL-2026-6135 blocks this version. Package is not a library. `main` points at `sw.js`, a browser Service Worker that uses `importScripts`, `self.addEventListe...
OpenSSF/OSV malware advisory MAL-2026-6130 blocks this version. The tarball is a static-site / web-proxy build (index.html, /assets/*.js bundles with obfuscated names, a.well-known/discor...
OpenSSF/OSV malware advisory MAL-2026-6128 blocks this version. Package is published under a deceptive identity. package.json declares main=sw.js, but sw.js is a service-worker entry (imp...
OpenSSF/OSV malware advisory MAL-2026-6129 blocks this version. The tarball contains a static-site bundle (index.html, obfuscated asset chunks, service worker sw.js, and the MercuryWorksh...
OpenSSF/OSV malware advisory MAL-2026-5916 blocks this version. The tarball is not a Node library. `package.json` declares `main: sw.js` with description `"package"` and an empty author;...
OpenSSF/OSV malware advisory MAL-2026-5915 blocks this version. The package is one of approximately 100 identically-named-pattern publishes from an automated bulk-publish operation. The t...
OpenSSF/OSV malware advisory MAL-2026-5914 blocks this version. nottuff15 is one entry in a coordinated npm namespace-spam campaign. The tarball ships auto-publish.sh, a bash script that...
OpenSSF/OSV malware advisory MAL-2026-5918 blocks this version. This package is one of ~95 names in a coordinated spam-publication family (nottuff1-30, ishowfeet1-20, imillegal1-5, abuden...
OpenSSF/OSV malware advisory MAL-2026-5917 blocks this version. Package ships a Scramjet-based web proxy (sw.js service worker + bare-mux + WASM rewriter under assets/) plus a static 'Riv...
OpenSSF/OSV malware advisory MAL-2026-6484 blocks this version. The package advertises itself as a 5-line random-string generator, but index.js (the declared main) contains a hardcoded AE...
OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...
OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...
OpenSSF/OSV malware advisory MAL-2026-5534 blocks this version. The package ships a `postinstall` lifecycle script (`sec_check.js`) that fires automatically on `npm install`. The script f...
OpenSSF/OSV malware advisory MAL-2026-5534 blocks this version. The package ships a `postinstall` lifecycle script (`sec_check.js`) that fires automatically on `npm install`. The script f...
OpenSSF/OSV malware advisory MAL-2026-5835 blocks this version. On `npm install`, the package's `postinstall` hook runs `sec_check.js`, which enumerates the host's network interfaces and...
OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...
OpenSSF/OSV malware advisory MAL-2026-5896 blocks this version. The package advertises itself as a Jest plugin (name: 'jest-test-plugin-utils', description: 'mqtt utils') but ships no Jes...