npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 531
Updated 24 Oct 2026, 09:21 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-10937 blocks this version. The twilio-serverless package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace publishe...
OpenSSF/OSV malware advisory MAL-2026-11039 blocks this version. Package yuinpm@2026.7.19-2 contains 3 files and produced no a static rule matches and no traced-code findings indicating e...
OpenSSF/OSV malware advisory MAL-2026-11063 blocks this version. index.js runs as a preinstall lifecycle script on npm install. It collects host identity and network configuration — os.ho...
OpenSSF/OSV malware advisory MAL-2026-10764 blocks this version. The syft-acp-atoms package was published to the npm registry by user 'ada8877' (maintainer email k3mlol@proton.me) as part...
OpenSSF/OSV malware advisory MAL-2026-10670 blocks this version. The package's postinstall script (scripts/install-check.cjs) fetches a JSON config from https://slimopump.vercel.app/confi...
OpenSSF/OSV malware advisory MAL-2026-10489 blocks this version. The package's `main` (index.js) is a 10-line FFI shim that spawns a worker, dlopens the bundled `lib-linux.so` via koffi,...
OpenSSF/OSV malware advisory MAL-2026-11104 blocks this version. Review of tailwind-motionkit@1.0.3 surfaced no evidence of exfiltration, install-time remote code execution, silent relay,...
OpenSSF/OSV malware advisory MAL-2026-5729 blocks this version. Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-12108 blocks this version. This package is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js at lines 425 and 436, code uses Str...
OpenSSF/OSV malware advisory MAL-2026-12108 blocks this version. This package is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js at lines 425 and 436, code uses Str...
OpenSSF/OSV malware advisory MAL-2026-12108 blocks this version. This package is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js at lines 425 and 436, code uses Str...
OpenSSF/OSV malware advisory MAL-2026-12097 blocks this version. Package advertises itself as a drop-in replacement for bip39 and exposes stub wallet functions (createWallet, generateMnem...
OpenSSF/OSV malware advisory MAL-2026-12090 blocks this version. Package advertises itself as a 'drop-in replacement for dockerode' but the main module (index.js) has no Docker functional...
OpenSSF/OSV malware advisory MAL-2026-12103 blocks this version. @wethenorth12/spl-token-utils advertises itself as a drop-in replacement for @solana/spl-token. On require(), index.js ser...
OpenSSF/OSV malware advisory MAL-2026-12102 blocks this version. On require of the package's main entry (index.js), the code collects process.env, hostname, username, homedir, platform, c...
OpenSSF/OSV malware advisory MAL-2026-12101 blocks this version. On require(), index.js JSON-encodes the full process.env plus hostname, username, homedir, platform, cwd, and package meta...
OpenSSF/OSV malware advisory MAL-2026-12100 blocks this version. @wethenorth12/solana-spl-token is a typosquat of the legitimate @solana/spl-token package. On module load, index.js collec...
OpenSSF/OSV malware advisory MAL-2026-12099 blocks this version. @wethenorth12/playwrite is a typosquat of the popular 'playwright' package. On require(), index.js collects process.env, h...
OpenSSF/OSV malware advisory MAL-2026-12098 blocks this version. Package @wethenorth12/near-api is presented as a 'drop-in replacement' for near-api-js and falls back to require('near-api...
OpenSSF/OSV malware advisory MAL-2026-12096 blocks this version. index.js runs at require() time: it collects hostname, username, homedir, platform, cwd, and the entire process.env, JSON-...
OpenSSF/OSV malware advisory MAL-2026-12095 blocks this version. @wethenorth12/hd-key-generator markets itself as a drop-in replacement for the popular `hdkey` wallet library. On require,...
OpenSSF/OSV malware advisory MAL-2026-12094 blocks this version. The package presents itself as a drop-in replacement for the ethers library (author metadata `ethers-io`, repository URL p...
OpenSSF/OSV malware advisory MAL-2026-12093 blocks this version. On require(), index.js collects the host's hostname, username, home directory, platform, current working directory, and th...
OpenSSF/OSV malware advisory MAL-2026-12092 blocks this version. @wethenorth12/etherjs@6.15.3 is a typosquat of the ethers package (package name, description, and author string 'ricmoo' a...
OpenSSF/OSV malware advisory MAL-2026-12092 blocks this version. @wethenorth12/etherjs@6.15.3 is a typosquat of the ethers package (package name, description, and author string 'ricmoo' a...