npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 530
Updated 24 Oct 2026, 08:49 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-11487 blocks this version. index.js hides a base64-encoded payload after a long run of tab characters and executes it via eval(atob(...)) at module l...
OpenSSF/OSV malware advisory MAL-2026-11103 blocks this version. stargateproxyserv@28.0.0 declares a `preinstall` script that runs `node index.js`, which collects installer host identifie...
OpenSSF/OSV malware advisory MAL-2026-11461 blocks this version. The package presents itself as an Ethereum bridge library but its index.js is a verbatim copy of the well-known eth-sig-ut...
OpenSSF/OSV malware advisory MAL-2026-11062 blocks this version. The package's preinstall hook executes index.js, which collects host identifiers (os.hostname(), os.platform(), os.arch(),...
OpenSSF/OSV malware advisory MAL-2026-11098 blocks this version. crm-reportinsightserv-paypal@28.0.0 executes a preinstall script (index.js) that collects installer host identifiers — os....
OpenSSF/OSV malware advisory MAL-2026-11058 blocks this version. payoutsvettingserv-paypal@28.0.0 declares `preinstall: node index.js` in package.json, causing index.js to run automatical...
OpenSSF/OSV malware advisory MAL-2026-11057 blocks this version. The package's preinstall script (index.js) executes automatically on `npm install` and collects host identifiers — hostnam...
OpenSSF/OSV malware advisory MAL-2026-11057 blocks this version. The package's preinstall script (index.js) executes automatically on `npm install` and collects host identifiers — hostnam...
OpenSSF/OSV malware advisory MAL-2026-11061 blocks this version. The package's preinstall hook runs index.js, which collects hostname, platform, architecture, home directory, and DNS serv...
OpenSSF/OSV malware advisory MAL-2026-11102 blocks this version. Package installs a preinstall hook that runs index.js on npm install. The script collects the installer's hostname, platfo...
OpenSSF/OSV malware advisory MAL-2026-11100 blocks this version. identityauthorizationserv@28.0.0 wires scripts.preinstall to node index.js, so on npm install the package auto-executes co...
OpenSSF/OSV malware advisory MAL-2026-2785 blocks this version. On `npm install`, the package's `preinstall` hook executes `index.js`, which collects host identifiers (os.hostname(), os.p...
OpenSSF/OSV malware advisory MAL-2026-5172 blocks this version. LPM AI assessed this version as clean; the assessments disagree. package.json declares scripts.preinstall = 'node index.js'...
OpenSSF/OSV malware advisory MAL-2026-11037 blocks this version. svelte-goal-streak@1.0.0 shows no evidence of exfiltration, install-time code fetching, credential access, silent-relay, b...
OpenSSF/OSV malware advisory MAL-2026-11038 blocks this version. The package contains no static or traced indicators of exfiltration, install-time remote code execution, silent-relay, cre...
OpenSSF/OSV malware advisory MAL-2026-7012 blocks this version. The npm package `express-mongo-limit` masquerades as an Express/MongoDB payload sanitization middleware (likely typosquatti...
OpenSSF/OSV malware advisory MAL-2026-10983 blocks this version. Analysis of svelte-streaks@1.0.0 surfaced no a static rule matches and no traced behaviors indicative of credential theft,...
OpenSSF/OSV malware advisory MAL-2026-10983 blocks this version. Analysis of svelte-streaks@1.0.0 surfaced no a static rule matches and no traced behaviors indicative of credential theft,...
OpenSSF/OSV malware advisory MAL-2026-10983 blocks this version. Analysis of svelte-streaks@1.0.0 surfaced no a static rule matches and no traced behaviors indicative of credential theft,...
OpenSSF/OSV malware advisory MAL-2026-11008 blocks this version. LPM AI assessed this version as clean; the assessments disagree. No a static rule matches and no traced behavioral finding...
OpenSSF/OSV malware advisory MAL-2026-10967 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package commonweb-moneymovement@99.9.1 contains 2 fi...
OpenSSF/OSV malware advisory MAL-2026-11052 blocks this version. LPM AI assessed this version as clean; the assessments disagree. Analysis of app-data-layer@2.1.6 (3 files scanned) produc...
OpenSSF/OSV malware advisory MAL-2026-10934 blocks this version. The twilio-internal package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published...
OpenSSF/OSV malware advisory MAL-2026-10933 blocks this version. The twilio-deploy package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by...
OpenSSF/OSV malware advisory MAL-2026-10932 blocks this version. The twilio-assets package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by...