npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 532
Updated 24 Oct 2026, 09:52 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-12092 blocks this version. @wethenorth12/etherjs@6.15.3 is a typosquat of the ethers package (package name, description, and author string 'ricmoo' a...
OpenSSF/OSV malware advisory MAL-2026-12092 blocks this version. @wethenorth12/etherjs@6.15.3 is a typosquat of the ethers package (package name, description, and author string 'ricmoo' a...
OpenSSF/OSV malware advisory MAL-2026-12092 blocks this version. @wethenorth12/etherjs@6.15.3 is a typosquat of the ethers package (package name, description, and author string 'ricmoo' a...
OpenSSF/OSV malware advisory MAL-2026-12092 blocks this version. @wethenorth12/etherjs@6.15.3 is a typosquat of the ethers package (package name, description, and author string 'ricmoo' a...
OpenSSF/OSV malware advisory MAL-2026-12091 blocks this version. On require(), index.js reads the full process.env map along with hostname, username, homedir, platform, and cwd, JSON-stri...
OpenSSF/OSV malware advisory MAL-2026-12089 blocks this version. On require, index.js collects process.env, hostname, username, homedir, platform, and cwd, base64-encodes the blob, and PO...
OpenSSF/OSV malware advisory MAL-2026-12087 blocks this version. On require(), index.js reads the entire process.env plus host identifiers (hostname, username, homedir, platform, cwd, tim...
OpenSSF/OSV malware advisory MAL-2026-12088 blocks this version. On require(), index.js collects the full process.env object together with hostname, username, home directory, platform, cu...
OpenSSF/OSV malware advisory MAL-2026-12086 blocks this version. On require of the package's main entrypoint, the module collects hostname, username, home directory, platform, cwd, and th...
OpenSSF/OSV malware advisory MAL-2026-12085 blocks this version. Package presents itself as a drop-in replacement for the popular `bip39` library but ships a credential stealer in its mai...
OpenSSF/OSV malware advisory MAL-2026-12107 blocks this version. On module load, index.js collects the host identifiers (os.hostname(), os.userInfo().username, home directory, platform, c...
OpenSSF/OSV malware advisory MAL-2026-12106 blocks this version. Package name mimics MetaMask's official web3-provider-engine and its README advertises a drop-in replacement, but the expo...
OpenSSF/OSV malware advisory MAL-2026-12104 blocks this version. On require() of the package, index.js collects the machine hostname, OS username, package name, and a timestamp and sends...
OpenSSF/OSV malware advisory MAL-2026-12105 blocks this version. The package presents itself as a drop-in replacement for the legitimate tronweb SDK (author field 'tronprotocol', README a...
OpenSSF/OSV malware advisory MAL-2026-11181 blocks this version. The package is advertised as a docs/landing site for 'Theta Data API', but its main entry (index.js) re-exports a single v...
OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...
OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...
OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...
OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...
OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...
OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...
OpenSSF/OSV malware advisory MAL-2026-11105 blocks this version. package.json declares a `preinstall` script that runs `node index.js` on `npm install`. index.js collects host identifiers...
OpenSSF/OSV malware advisory MAL-2026-11090 blocks this version. Package txs-random-lib@1.0.1 was inspected but no concrete a static rule matches or traced-code findings are available for...
OpenSSF/OSV malware advisory MAL-2026-11024 blocks this version. Package presents itself as a `create-*-project` scaffolder but ships no scaffolding functionality. The `bin/run.js` entry,...
OpenSSF/OSV malware advisory MAL-2026-11309 blocks this version. No a static rule matches and no traced-code findings are available for this package version. With no concrete behavioral e...