npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 533
Updated 25 Oct 2026, 10:33 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4495 blocks this version. On `npm install`, the package's `install` lifecycle hook runs `node index.js`, which loads `lib/core.js`. That module reads...
OpenSSF/OSV malware advisory MAL-2026-4199 blocks this version. ts-logger-pack is a malicious npm package that depends on terminal-logger-utils and triggers the malicious behavior in that...
OpenSSF/OSV malware advisory MAL-2026-4164 blocks this version. The package identitysecuretokenserv was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4164 blocks this version. The package identitysecuretokenserv was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3849 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-3862 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-3849 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-3862 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4467 blocks this version. Package is a near-verbatim republication of the popular `dotenv` library (same README, API, and file layout) under the `@we...
OpenSSF/OSV malware advisory MAL-2026-4466 blocks this version. `@weirdorg/config` impersonates the widely-used `config` (node-config) package, copying its README verbatim including the `...
OpenSSF/OSV malware advisory MAL-2026-4640 blocks this version. Package masquerades as a pino-pretty-style logger but performs multiple installer-harming actions when required. On import,...
OpenSSF/OSV malware advisory MAL-2026-4481 blocks this version. On `npm install`, the package's postinstall hook runs `id` to capture the installer's uid/gid/group identity and opens a ra...
OpenSSF/OSV malware advisory MAL-2026-4422 blocks this version. Package `@qwedqwed/axios` is published under a scope that does not belong to the real axios maintainers but copies axios's...
OpenSSF/OSV malware advisory MAL-2026-4502 blocks this version. bucket-protocol-sdk-v2 advertises itself as a 'community maintained drop-in replacement' for the Sui ecosystem's bucket-pro...
OpenSSF/OSV malware advisory MAL-2026-4499 blocks this version. Package executes a DNS-based beacon at both install time (package.json scripts.install runs `node index.js`) and on every `...
OpenSSF/OSV malware advisory MAL-2026-4502 blocks this version. bucket-protocol-sdk-v2 advertises itself as a 'community maintained drop-in replacement' for the Sui ecosystem's bucket-pro...
OpenSSF/OSV malware advisory MAL-2026-4502 blocks this version. bucket-protocol-sdk-v2 advertises itself as a 'community maintained drop-in replacement' for the Sui ecosystem's bucket-pro...
OpenSSF/OSV malware advisory MAL-2026-4502 blocks this version. bucket-protocol-sdk-v2 advertises itself as a 'community maintained drop-in replacement' for the Sui ecosystem's bucket-pro...
OpenSSF/OSV malware advisory MAL-2026-4502 blocks this version. bucket-protocol-sdk-v2 advertises itself as a 'community maintained drop-in replacement' for the Sui ecosystem's bucket-pro...
OpenSSF/OSV malware advisory MAL-2026-4502 blocks this version. bucket-protocol-sdk-v2 advertises itself as a 'community maintained drop-in replacement' for the Sui ecosystem's bucket-pro...
OpenSSF/OSV malware advisory MAL-2026-4502 blocks this version. bucket-protocol-sdk-v2 advertises itself as a 'community maintained drop-in replacement' for the Sui ecosystem's bucket-pro...
OpenSSF/OSV malware advisory MAL-2026-4553 blocks this version. Package name impersonates the official @ethersproject/wallet, and package.json spoofs the ethers.js maintainer identity (au...
OpenSSF/OSV malware advisory MAL-2026-4554 blocks this version. The package impersonates the legitimate @ethersproject/wallet (source files are otherwise verbatim copies, including the in...
OpenSSF/OSV malware advisory MAL-2026-4554 blocks this version. The package impersonates the legitimate @ethersproject/wallet (source files are otherwise verbatim copies, including the in...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...