npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 531
Updated 25 Oct 2026, 09:10 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4509 blocks this version. The package presents itself as a React OTP component, but its only exported widget hardcodes a single Firebase Realtime Dat...
OpenSSF/OSV malware advisory MAL-2026-4699 blocks this version. Package metadata advertises 'utility mf' with main 'index.js', but the shipped main is a 15.7MB obfuscator.io-style blob pr...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-4393 blocks this version. Package name impersonates the well-known `libsignal-node` Signal Protocol library and ships a verbatim copy of its README,...
OpenSSF/OSV malware advisory MAL-2026-4336 blocks this version. package.json declares both `preinstall` and `postinstall` hooks that execute `index.js`, which exfiltrates installer data t...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...
OpenSSF/OSV malware advisory MAL-2026-4699 blocks this version. Package metadata advertises 'utility mf' with main 'index.js', but the shipped main is a 15.7MB obfuscator.io-style blob pr...
OpenSSF/OSV malware advisory MAL-2026-4212 blocks this version. A coordinated supply-chain attack comprising 9 npm packages published by maintainer `polymarketdev` (GitHub actor `texselli...
OpenSSF/OSV malware advisory MAL-2026-4215 blocks this version. A coordinated supply-chain attack comprising 9 npm packages published by maintainer `polymarketdev` (GitHub actor `texselli...
OpenSSF/OSV malware advisory MAL-2026-4213 blocks this version. A coordinated supply-chain attack comprising 9 npm packages published by maintainer `polymarketdev` (GitHub actor `texselli...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4642 blocks this version. The package presents a Polygon/Polymarket validation/crypto utility but its exported APIs silently relay caller data to a h...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...