npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 534
Updated 25 Oct 2026, 11:11 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4554 blocks this version. The package impersonates the legitimate @ethersproject/wallet (source files are otherwise verbatim copies, including the in...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4427 blocks this version. On `npm install`, both `preinstall` and `postinstall` lifecycle hooks execute `postinstall.js`, which collects host identif...
OpenSSF/OSV malware advisory MAL-2026-4507 blocks this version. Package name mimics Coinbase's internal `cb-wallet-*` namespace to capture dependency-confusion resolutions. On `npm instal...
OpenSSF/OSV malware advisory MAL-2026-4506 blocks this version. Package name 'cb-wallet-data' targets a presumed Coinbase-internal namespace and is published by an unaffiliated party. Bot...
OpenSSF/OSV malware advisory MAL-2026-4740 blocks this version. The package is published as 'zod-to-js' but ships a copy of pino's source tree (main entry `pino.js`, lib/proto.js, lib/lev...
OpenSSF/OSV malware advisory MAL-2026-4501 blocks this version. The package presents itself as a clone of juliangruber/balanced-match (stolen author identity 'Julian Gruber <mail@juliangr...
OpenSSF/OSV malware advisory MAL-2026-4501 blocks this version. The package presents itself as a clone of juliangruber/balanced-match (stolen author identity 'Julian Gruber <mail@juliangr...
OpenSSF/OSV malware advisory MAL-2026-4655 blocks this version. The package's `install` lifecycle script (`node index.js`) and its main entry both load `lib/core.js`, which reads `os.user...
OpenSSF/OSV malware advisory MAL-2026-4655 blocks this version. The package's `install` lifecycle script (`node index.js`) and its main entry both load `lib/core.js`, which reads `os.user...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-4740 blocks this version. The package is published as 'zod-to-js' but ships a copy of pino's source tree (main entry `pino.js`, lib/proto.js, lib/lev...
OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...
OpenSSF/OSV malware advisory MAL-2026-4503 blocks this version. The package masquerades as a pino-like logging middleware (README is copied from pino, exports a `pino` property, mimics pi...
OpenSSF/OSV malware advisory MAL-2026-3774 blocks this version. The package masquerades as a TypeScript helper library (README is lifted from Microsoft's tslib and references --importHelp...
OpenSSF/OSV malware advisory MAL-2026-3774 blocks this version. The package masquerades as a TypeScript helper library (README is lifted from Microsoft's tslib and references --importHelp...
OpenSSF/OSV malware advisory MAL-2026-3775 blocks this version. Package name 'tsliverhome' impersonates the widely-used 'tslib' package (~300M weekly downloads). The shipped README.md is...
OpenSSF/OSV malware advisory MAL-2026-3769 blocks this version. Package impersonates the popular `prettier` formatter — README and description are copied verbatim from the real Prettier p...
OpenSSF/OSV malware advisory MAL-2026-3769 blocks this version. Package impersonates the popular `prettier` formatter — README and description are copied verbatim from the real Prettier p...
OpenSSF/OSV malware advisory MAL-2026-3775 blocks this version. Package name 'tsliverhome' impersonates the widely-used 'tslib' package (~300M weekly downloads). The shipped README.md is...
OpenSSF/OSV malware advisory MAL-2026-3775 blocks this version. Package name 'tsliverhome' impersonates the widely-used 'tslib' package (~300M weekly downloads). The shipped README.md is...
OpenSSF/OSV malware advisory MAL-2026-3770 blocks this version. prisma-callback@1.0.3 is a name-confusion package against the genuine `prisma` ORM. Its `package.json` declares `"preinstal...
OpenSSF/OSV malware advisory MAL-2026-3770 blocks this version. prisma-callback@1.0.3 is a name-confusion package against the genuine `prisma` ORM. Its `package.json` declares `"preinstal...
OpenSSF/OSV malware advisory MAL-2026-3770 blocks this version. prisma-callback@1.0.3 is a name-confusion package against the genuine `prisma` ORM. Its `package.json` declares `"preinstal...
OpenSSF/OSV malware advisory MAL-2026-3775 blocks this version. Package name 'tsliverhome' impersonates the widely-used 'tslib' package (~300M weekly downloads). The shipped README.md is...