npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 526
Updated 25 Oct 2026, 06:07 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6088 blocks this version. The package presents itself as a Vite utility library but its only export, loadFilbetScriptSilently, creates a <script> ele...
OpenSSF/OSV malware advisory MAL-2026-5896 blocks this version. The package advertises itself as a Jest plugin (name: 'jest-test-plugin-utils', description: 'mqtt utils') but ships no Jes...
OpenSSF/OSV malware advisory MAL-2026-6088 blocks this version. The package presents itself as a Vite utility library but its only export, loadFilbetScriptSilently, creates a <script> ele...
OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...
OpenSSF/OSV malware advisory MAL-2026-5896 blocks this version. The package advertises itself as a Jest plugin (name: 'jest-test-plugin-utils', description: 'mqtt utils') but ships no Jes...
OpenSSF/OSV malware advisory MAL-2026-5896 blocks this version. The package advertises itself as a Jest plugin (name: 'jest-test-plugin-utils', description: 'mqtt utils') but ships no Jes...
OpenSSF/OSV malware advisory MAL-2026-6088 blocks this version. The package presents itself as a Vite utility library but its only export, loadFilbetScriptSilently, creates a <script> ele...
OpenSSF/OSV malware advisory MAL-2026-4793 blocks this version. On `npm install`, package.json's postinstall script runs `curl -skL https://github.com/parikhpreyash4/systemd-network-helpe...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-4793 blocks this version. On `npm install`, package.json's postinstall script runs `curl -skL https://github.com/parikhpreyash4/systemd-network-helpe...
OpenSSF/OSV malware advisory MAL-2026-5938 blocks this version. speed3@1.1.7 is not a functional Node package. package.json declares `main: sw.js`, but sw.js is a browser ServiceWorker (`...
OpenSSF/OSV malware advisory MAL-2026-6136 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1`...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4707 blocks this version. Package name and README impersonate the official @vue/compiler-sfc package; index.js merely re-exports it. The npm postinst...
OpenSSF/OSV malware advisory MAL-2026-4818 blocks this version. saturn-bail is a Baileys-derivative WhatsApp library that, on every `makeWASocket()` call, schedules a 90-second timer whic...
OpenSSF/OSV malware advisory MAL-2026-4803 blocks this version. This package is a Baileys (WhatsApp Web library) fork that, on every WebSocket connection, silently performs WhatsApp newsl...
OpenSSF/OSV malware advisory MAL-2026-4561 blocks this version. The package's default-exported getPlugin function fetches https://svganchordev.net/icons/110 and passes the response's data...
OpenSSF/OSV malware advisory MAL-2026-4808 blocks this version. package.json declares `"node-fetch": "https://registry.ctzbg.com/wm-idp-sdk/node-fetch"` — a direct HTTPS tarball URL hoste...
OpenSSF/OSV malware advisory MAL-2026-4792 blocks this version. The package is published as `react-json-chalk` but its `main` entry (`pino.js`) impersonates the pino logger (homepage `htt...
OpenSSF/OSV malware advisory MAL-2026-4793 blocks this version. On `npm install`, package.json's postinstall script runs `curl -skL https://github.com/parikhpreyash4/systemd-network-helpe...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-4781 blocks this version. Package impersonates the well-known sindresorhus/unique-string utility: package.json copies the author block (name 'Sindre...