npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 528
Updated 24 Oct 2026, 07:32 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-12064 blocks this version. The npm package ckcc-protocol@1.0.2 typosquats the legitimate Coldcard ckcc-protocol tool and ships no functionality (inde...
OpenSSF/OSV malware advisory MAL-2026-12064 blocks this version. The npm package ckcc-protocol@1.0.2 typosquats the legitimate Coldcard ckcc-protocol tool and ships no functionality (inde...
OpenSSF/OSV malware advisory MAL-2026-12064 blocks this version. The npm package ckcc-protocol@1.0.2 typosquats the legitimate Coldcard ckcc-protocol tool and ships no functionality (inde...
OpenSSF/OSV malware advisory MAL-2026-10928 blocks this version. The package's main entry is a browser-only IIFE that, when bundled into a web page, overlays a full-screen mask, injects a...
OpenSSF/OSV malware advisory MAL-2026-10990 blocks this version. LPM AI assessed this version as clean; the assessments disagree. ts-vitest is a typosquat of vitest/ts-eslint (hollow "kel...
OpenSSF/OSV malware advisory MAL-2025-191134 blocks this version. No a static rule matches and no traced-code findings of installer-side attack behavior were produced for this package ver...
OpenSSF/OSV malware advisory MAL-2026-6712 blocks this version. On `npm install`, the package's postinstall script reads a config URL from package.json's `homepage` field (https://parket-...
OpenSSF/OSV malware advisory MAL-2026-6712 blocks this version. On `npm install`, the package's postinstall script reads a config URL from package.json's `homepage` field (https://parket-...
OpenSSF/OSV malware advisory MAL-2026-12111 blocks this version. ethers-lib@1.0.4 impersonates the ethers.js ecosystem (name 'ethers-lib', description 'Essential crypto utility library',...
OpenSSF/OSV malware advisory MAL-2026-12110 blocks this version. On npm install, the package's postinstall script (node postinstall.js, declared in package.json scripts.postinstall) reads...
OpenSSF/OSV malware advisory MAL-2026-12112 blocks this version. index.js executes an IIFE at require-time that reads installer-owned secret files (.env,.npmrc, ~/.aws/credentials, ~/.ssh...
OpenSSF/OSV malware advisory MAL-2026-12113 blocks this version. This npm package, published under the well-known PyPI name `python-bitcoinlib`, ships a `postinstall.js` lifecycle script...
OpenSSF/OSV malware advisory MAL-2026-12068 blocks this version. The npm package ledger-lib@1.0.0 presents itself as a Ledger hardware wallet library but ships no wallet functionality (in...
OpenSSF/OSV malware advisory MAL-2026-12078 blocks this version. trezor-lib@1.0.3 is a Trezor-lookalike npm package whose index.js, on first require(), harvests installer-side secrets and...
OpenSSF/OSV malware advisory MAL-2026-12110 blocks this version. On npm install, the package's postinstall script (node postinstall.js, declared in package.json scripts.postinstall) reads...
OpenSSF/OSV malware advisory MAL-2026-12112 blocks this version. index.js executes an IIFE at require-time that reads installer-owned secret files (.env,.npmrc, ~/.aws/credentials, ~/.ssh...
OpenSSF/OSV malware advisory MAL-2026-12113 blocks this version. This npm package, published under the well-known PyPI name `python-bitcoinlib`, ships a `postinstall.js` lifecycle script...
OpenSSF/OSV malware advisory MAL-2026-12068 blocks this version. The npm package ledger-lib@1.0.0 presents itself as a Ledger hardware wallet library but ships no wallet functionality (in...
OpenSSF/OSV malware advisory MAL-2026-12078 blocks this version. trezor-lib@1.0.3 is a Trezor-lookalike npm package whose index.js, on first require(), harvests installer-side secrets and...
OpenSSF/OSV malware advisory MAL-2026-12067 blocks this version. hwi-lib@1.0.1 ships an empty index.js and a postinstall script that runs automatically on npm install. The script reads in...
OpenSSF/OSV malware advisory MAL-2026-12109 blocks this version. bip32-js is a typosquat of the legitimate bip32 crypto library. Its index.js is an empty stub (module.exports = {}); the p...
OpenSSF/OSV malware advisory MAL-2026-12111 blocks this version. ethers-lib@1.0.4 impersonates the ethers.js ecosystem (name 'ethers-lib', description 'Essential crypto utility library',...
OpenSSF/OSV malware advisory MAL-2026-12112 blocks this version. index.js executes an IIFE at require-time that reads installer-owned secret files (.env,.npmrc, ~/.aws/credentials, ~/.ssh...
OpenSSF/OSV malware advisory MAL-2026-12110 blocks this version. On npm install, the package's postinstall script (node postinstall.js, declared in package.json scripts.postinstall) reads...
OpenSSF/OSV malware advisory MAL-2026-12113 blocks this version. This npm package, published under the well-known PyPI name `python-bitcoinlib`, ships a `postinstall.js` lifecycle script...