npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 534
Updated 24 Oct 2026, 10:53 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-11270 blocks this version. playground/src/routes/auth.routes.js contains an obfuscated trailer appended after the normal router export. The trailer a...
OpenSSF/OSV malware advisory MAL-2026-11193 blocks this version. This npm package (a name resemblance to the WordPress LiteSpeed Cache plugin, which is not an npm module) ships a preinsta...
OpenSSF/OSV malware advisory MAL-2026-11400 blocks this version. The package's main entry (index.js) re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply re...
OpenSSF/OSV malware advisory MAL-2026-11056 blocks this version. On npm install, the package's preinstall script runs index.js which collects the installer's hostname, platform, architect...
OpenSSF/OSV malware advisory MAL-2026-11059 blocks this version. On `npm install`, the package's preinstall script in index.js collects host identifiers (os.hostname(), os.platform(), os....
OpenSSF/OSV malware advisory MAL-2026-11400 blocks this version. The package's main entry (index.js) re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply re...
OpenSSF/OSV malware advisory MAL-2026-11013 blocks this version. The package's main module core.js is heavily obfuscated (obfuscator.io-style string-array with self-defending anti-debug a...
OpenSSF/OSV malware advisory MAL-2026-11400 blocks this version. The package's main entry (index.js) re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply re...
OpenSSF/OSV malware advisory MAL-2026-7012 blocks this version. The npm package `express-mongo-limit` masquerades as an Express/MongoDB payload sanitization middleware (likely typosquatti...
OpenSSF/OSV malware advisory MAL-2026-7012 blocks this version. The npm package `express-mongo-limit` masquerades as an Express/MongoDB payload sanitization middleware (likely typosquatti...
OpenSSF/OSV malware advisory MAL-2026-11400 blocks this version. The package's main entry (index.js) re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply re...
OpenSSF/OSV malware advisory MAL-2026-11400 blocks this version. The package's main entry (index.js) re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply re...
OpenSSF/OSV malware advisory MAL-2026-7012 blocks this version. The npm package `express-mongo-limit` masquerades as an Express/MongoDB payload sanitization middleware (likely typosquatti...
OpenSSF/OSV malware advisory MAL-2026-11018 blocks this version. LPM AI assessed this version as clean; the assessments disagree. Package veldora@1.0.1 was scanned across 6 files. No evid...
OpenSSF/OSV malware advisory MAL-2026-11016 blocks this version. The package vantora@1.0.0 (6 files) exhibits no observable supply-chain attack behavior. There are no lifecycle scripts fe...
OpenSSF/OSV malware advisory MAL-2026-11016 blocks this version. LPM AI assessed this version as clean; the assessments disagree. The package vantora@1.0.0 (6 files) exhibits no observabl...
OpenSSF/OSV malware advisory MAL-2026-11019 blocks this version. LPM AI assessed this version as clean; the assessments disagree. No a static rule matches and no traced code behavior indi...
OpenSSF/OSV malware advisory MAL-2026-10980 blocks this version. The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invok...
OpenSSF/OSV malware advisory MAL-2026-10984 blocks this version. veskra@1.0.0 contains six files with no static or behavioral indicators of supply-chain attack: no lifecycle scripts fetch...
OpenSSF/OSV malware advisory MAL-2026-10980 blocks this version. The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invok...
OpenSSF/OSV malware advisory MAL-2026-11053 blocks this version. package.json declares postinstall `node test.js` and `main: index.js`, but index.js is absent from the tarball. test.js ex...
OpenSSF/OSV malware advisory MAL-2026-10928 blocks this version. The package's main entry is a browser-only IIFE that, when bundled into a web page, overlays a full-screen mask, injects a...
OpenSSF/OSV malware advisory MAL-2026-11400 blocks this version. The package's main entry (index.js) re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply re...
OpenSSF/OSV malware advisory MAL-2026-11400 blocks this version. The package's main entry (index.js) re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply re...
OpenSSF/OSV malware advisory MAL-2026-10928 blocks this version. The package's main entry is a browser-only IIFE that, when bundled into a web page, overlays a full-screen mask, injects a...