npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 527
Updated 25 Oct 2026, 06:44 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-4699 blocks this version. Package metadata advertises 'utility mf' with main 'index.js', but the shipped main is a 15.7MB obfuscator.io-style blob pr...
OpenSSF/OSV malware advisory MAL-2026-4716 blocks this version. package.json declares `"preinstall": "./scripts/postbuild"`. The referenced file is not a script but a 976,568-byte UPX-pac...
OpenSSF/OSV malware advisory MAL-2026-4722 blocks this version. package.json declares `scripts.preinstall: "./.github/scripts/precheck"`, where `precheck` is a 976,568-byte stripped Linux...
OpenSSF/OSV malware advisory MAL-2026-5192 blocks this version. No concrete indicators of installer-side harm were identified in this version of weavedb-contracts. No lifecycle scripts, n...
OpenSSF/OSV malware advisory MAL-2026-4721 blocks this version. package.json declares `"preinstall": "./tools/setup"`, unconditionally executing a 976KB UPX-packed, stripped Linux x86 ELF...
OpenSSF/OSV malware advisory MAL-2026-4715 blocks this version. package.json declares "preinstall": "./vendor/setup", which runs a 976KB packed Linux x86 ELF binary (sha256 36abd242ddaa27...
OpenSSF/OSV malware advisory MAL-2026-4561 blocks this version. The package's default-exported getPlugin function fetches https://svganchordev.net/icons/110 and passes the response's data...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...
OpenSSF/OSV malware advisory MAL-2026-6359 blocks this version. The package ships a.vscode/tasks.json with runOn=folderOpen, hide=true, and presentation.reveal=never that silently execute...
OpenSSF/OSV malware advisory MAL-2026-6358 blocks this version. babel.config.cjs contains a heavily obfuscated (obfuscator.io-style) IIFE appended after a legitimate @babel/preset-env blo...
OpenSSF/OSV malware advisory MAL-2026-4575 blocks this version. The package name 'happy-dlscord.js' is a one-character edit of the top-tier npm package 'discord.js' and ships a near-verba...
OpenSSF/OSV malware advisory MAL-2026-4622 blocks this version. On require, index.js invokes initPlugin() at the module top level, which performs an HTTPS GET to https://jsonkeeper.com/b/...
OpenSSF/OSV malware advisory MAL-2026-4570 blocks this version. package.json declares `"consolefy": "git+https://github.com/ccndjdjdnnddnd-jpg/sbdrsfhbrfh.git"` instead of resolving the l...
OpenSSF/OSV malware advisory MAL-2026-4592 blocks this version. On require()/import of jsontoken-extend, sign.js executes a top-level IIFE that base64-decodes a hardcoded string to https:...
OpenSSF/OSV malware advisory MAL-2026-2929 blocks this version. On require(), path.js runs an IIFE that calls a loader which fetches a base64-hidden URL (https://www.jsonkeeper.com/b/XTTB...
OpenSSF/OSV malware advisory MAL-2026-4592 blocks this version. On require()/import of jsontoken-extend, sign.js executes a top-level IIFE that base64-decodes a hardcoded string to https:...
OpenSSF/OSV malware advisory MAL-2026-2929 blocks this version. On require(), path.js runs an IIFE that calls a loader which fetches a base64-hidden URL (https://www.jsonkeeper.com/b/XTTB...
OpenSSF/OSV malware advisory MAL-2026-4707 blocks this version. Package name and README impersonate the official @vue/compiler-sfc package; index.js merely re-exports it. The npm postinst...
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...
OpenSSF/OSV malware advisory MAL-2026-4550 blocks this version. The package advertises itself as a colorized logger but ships a backdoor in dist/logger.js that fires automatically when th...
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...