npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 535
Updated 25 Oct 2026, 11:45 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3770 blocks this version. prisma-callback@1.0.3 is a name-confusion package against the genuine `prisma` ORM. Its `package.json` declares `"preinstal...
OpenSSF/OSV malware advisory MAL-2026-3724 blocks this version. On `npm install`, the package's `preinstall.js` collects `os.hostname()` and `os.userInfo().username` and sends them as que...
OpenSSF/OSV malware advisory MAL-2026-3724 blocks this version. On `npm install`, the package's `preinstall.js` collects `os.hostname()` and `os.userInfo().username` and sends them as que...
OpenSSF/OSV malware advisory MAL-2026-3771 blocks this version. request-logger-canary@1.0.0 ships a preinstall.js that, when `npm install` runs, opens a TCP socket to 52.74.242.200:8851 a...
OpenSSF/OSV malware advisory MAL-2026-3750 blocks this version. On require()/import, index.js runs an IIFE that POSTs a getAccountInfo RPC call to https://api.devnet.solana.com for Solana...
OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...
OpenSSF/OSV malware advisory MAL-2026-3713 blocks this version. hardhat-core version 2.1.2 spawns a detached Node.js child process from index.js that runs lib/caller.js. The child decodes...
OpenSSF/OSV malware advisory MAL-2026-3777 blocks this version. Full C2 implant disguised as vue-template-compiler fork. postinstall-run.cjs loads tooling-bootstrap.cjs which contains bas...
OpenSSF/OSV malware advisory MAL-2026-3653 blocks this version. Package `@design-system-coopeuch/web@999.0.4` is a dependency-confusion squat of an internal-looking scope, published at an...
OpenSSF/OSV malware advisory MAL-2026-3653 blocks this version. Package `@design-system-coopeuch/web@999.0.4` is a dependency-confusion squat of an internal-looking scope, published at an...
OpenSSF/OSV malware advisory MAL-2026-3462 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3462 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3312 blocks this version. On require(), path.js executes an IIFE that calls loadTokenData(), which fetches a base64-obfuscated URL (decoding to https...
OpenSSF/OSV malware advisory MAL-2026-3028 blocks this version. npm stealer. Hardcoded Discord webhook id 1497047226428690432 in postinstall Folder/bin/S.js. Exfils {hostname, whoami, pwd...
OpenSSF/OSV malware advisory MAL-2026-2929 blocks this version. On require(), path.js runs an IIFE that calls a loader which fetches a base64-hidden URL (https://www.jsonkeeper.com/b/XTTB...
OpenSSF/OSV malware advisory MAL-2026-2446 blocks this version. index.js uses child_process to execute `whoami` and gather `hostname` information, then transmits results via https.get to...
OpenSSF/OSV malware advisory MAL-2026-2446 blocks this version. index.js uses child_process to execute `whoami` and gather `hostname` information, then transmits results via https.get to...
OpenSSF/OSV malware advisory MAL-2026-2407 blocks this version. Malicious package due to code obfuscation, dynamic module loading, process exposure, suspicious install script, and untrust...
OpenSSF/OSV malware advisory MAL-2026-2350 blocks this version. Package impersonates the popular `dotenv` package: `package.json` points its repository field to `git://github.com/motdotla...
OpenSSF/OSV malware advisory MAL-2025-47594 blocks this version. The package communicates with a domain associated with malicious activity.
OpenSSF/OSV malware advisory MAL-2025-41443 blocks this version. ## Summary
OpenSSF/OSV malware advisory MAL-2025-41443 blocks this version. ## Summary
OpenSSF/OSV malware advisory MAL-2025-41443 blocks this version. ## Summary
OpenSSF/OSV malware advisory MAL-2025-41443 blocks this version. ## Summary
OpenSSF/OSV malware advisory MAL-2025-41443 blocks this version. ## Summary