npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 529
Updated 24 Oct 2026, 08:10 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-12078 blocks this version. trezor-lib@1.0.3 is a Trezor-lookalike npm package whose index.js, on first require(), harvests installer-side secrets and...
OpenSSF/OSV malware advisory MAL-2026-12109 blocks this version. bip32-js is a typosquat of the legitimate bip32 crypto library. Its index.js is an empty stub (module.exports = {}); the p...
OpenSSF/OSV malware advisory MAL-2026-12111 blocks this version. ethers-lib@1.0.4 impersonates the ethers.js ecosystem (name 'ethers-lib', description 'Essential crypto utility library',...
OpenSSF/OSV malware advisory MAL-2026-12115 blocks this version. The package's main entry dist/index.mjs runs a top-level IIFE that chmod +x's a bundled ELF at dist/math-calc.bin and spaw...
OpenSSF/OSV malware advisory MAL-2026-12113 blocks this version. This npm package, published under the well-known PyPI name `python-bitcoinlib`, ships a `postinstall.js` lifecycle script...
OpenSSF/OSV malware advisory MAL-2026-12109 blocks this version. bip32-js is a typosquat of the legitimate bip32 crypto library. Its index.js is an empty stub (module.exports = {}); the p...
OpenSSF/OSV malware advisory MAL-2026-12111 blocks this version. ethers-lib@1.0.4 impersonates the ethers.js ecosystem (name 'ethers-lib', description 'Essential crypto utility library',...
OpenSSF/OSV malware advisory MAL-2026-12027 blocks this version. tailwind-anime@1.1.0 is a typosquat of tailwindcss-animate. Its index.js appends an eval(atob('...')) blob that runs whene...
OpenSSF/OSV malware advisory MAL-2026-11483 blocks this version. The package appears to be a small date-formatting utility. No credential access, no install-time or import-time network ac...
OpenSSF/OSV malware advisory MAL-2026-11500 blocks this version. index.js appends an eval(atob(...)) blob to an otherwise legitimate Tailwind plugin. On require(), the decoded loader quer...
OpenSSF/OSV malware advisory MAL-2026-11500 blocks this version. index.js appends an eval(atob(...)) blob to an otherwise legitimate Tailwind plugin. On require(), the decoded loader quer...
OpenSSF/OSV malware advisory MAL-2026-11500 blocks this version. index.js appends an eval(atob(...)) blob to an otherwise legitimate Tailwind plugin. On require(), the decoded loader quer...
OpenSSF/OSV malware advisory MAL-2026-11500 blocks this version. index.js appends an eval(atob(...)) blob to an otherwise legitimate Tailwind plugin. On require(), the decoded loader quer...
OpenSSF/OSV malware advisory MAL-2026-11487 blocks this version. index.js hides a base64-encoded payload after a long run of tab characters and executes it via eval(atob(...)) at module l...
OpenSSF/OSV malware advisory MAL-2026-11487 blocks this version. index.js hides a base64-encoded payload after a long run of tab characters and executes it via eval(atob(...)) at module l...
OpenSSF/OSV malware advisory MAL-2026-11487 blocks this version. index.js hides a base64-encoded payload after a long run of tab characters and executes it via eval(atob(...)) at module l...
OpenSSF/OSV malware advisory MAL-2026-11500 blocks this version. index.js appends an eval(atob(...)) blob to an otherwise legitimate Tailwind plugin. On require(), the decoded loader quer...
OpenSSF/OSV malware advisory MAL-2026-11487 blocks this version. index.js hides a base64-encoded payload after a long run of tab characters and executes it via eval(atob(...)) at module l...
OpenSSF/OSV malware advisory MAL-2026-11490 blocks this version. The package contains three files and produced no a static rule matches and no traced code behaviors of concern. The name a...
OpenSSF/OSV malware advisory MAL-2026-11492 blocks this version. No static or traced behavioral signals of supply-chain attack were observed in this package. There is no evidence of insta...
OpenSSF/OSV malware advisory MAL-2026-11505 blocks this version. On require() of accounts-loading-state, index.js loads setup.js which schedules bootstrap() via process.nextTick. bootstra...
OpenSSF/OSV malware advisory MAL-2026-11390 blocks this version. No malicious behaviors were identified in the package contents. No install-time lifecycle scripts fetching external code,...
OpenSSF/OSV malware advisory MAL-2026-11390 blocks this version. No malicious behaviors were identified in the package contents. No install-time lifecycle scripts fetching external code,...
OpenSSF/OSV malware advisory MAL-2026-11391 blocks this version. The package contains no code paths matching supply-chain attack fingerprints: no install/postinstall lifecycle hooks fetch...
OpenSSF/OSV malware advisory MAL-2026-11500 blocks this version. index.js appends an eval(atob(...)) blob to an otherwise legitimate Tailwind plugin. On require(), the decoded loader quer...