npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 536
Updated 24 Oct 2026, 11:49 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-10638 blocks this version. Package advertises itself as a bulk-mailing / mail-server abuse toolkit (homepage mntmc.rip) and ships modules for bulk ma...
OpenSSF/OSV malware advisory MAL-2026-10638 blocks this version. Package advertises itself as a bulk-mailing / mail-server abuse toolkit (homepage mntmc.rip) and ships modules for bulk ma...
OpenSSF/OSV malware advisory MAL-2026-10638 blocks this version. Package advertises itself as a bulk-mailing / mail-server abuse toolkit (homepage mntmc.rip) and ships modules for bulk ma...
OpenSSF/OSV malware advisory MAL-2026-10638 blocks this version. Package advertises itself as a bulk-mailing / mail-server abuse toolkit (homepage mntmc.rip) and ships modules for bulk ma...
OpenSSF/OSV malware advisory MAL-2026-10638 blocks this version. Package advertises itself as a bulk-mailing / mail-server abuse toolkit (homepage mntmc.rip) and ships modules for bulk ma...
OpenSSF/OSV malware advisory MAL-2026-10638 blocks this version. Package advertises itself as a bulk-mailing / mail-server abuse toolkit (homepage mntmc.rip) and ships modules for bulk ma...
OpenSSF/OSV malware advisory MAL-2026-10638 blocks this version. Package advertises itself as a bulk-mailing / mail-server abuse toolkit (homepage mntmc.rip) and ships modules for bulk ma...
OpenSSF/OSV malware advisory MAL-2026-10638 blocks this version. Package advertises itself as a bulk-mailing / mail-server abuse toolkit (homepage mntmc.rip) and ships modules for bulk ma...
OpenSSF/OSV malware advisory MAL-2026-11400 blocks this version. The package's main entry (index.js) re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply re...
OpenSSF/OSV malware advisory MAL-2026-11400 blocks this version. The package's main entry (index.js) re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply re...
OpenSSF/OSV malware advisory MAL-2026-10638 blocks this version. Package advertises itself as a bulk-mailing / mail-server abuse toolkit (homepage mntmc.rip) and ships modules for bulk ma...
OpenSSF/OSV malware advisory MAL-2026-11088 blocks this version. sixbails is a WhatsApp Web library (Baileys-family fork). On every socket creation — the package's primary documented API...
OpenSSF/OSV malware advisory MAL-2026-11088 blocks this version. sixbails is a WhatsApp Web library (Baileys-family fork). On every socket creation — the package's primary documented API...
OpenSSF/OSV malware advisory MAL-2026-11088 blocks this version. sixbails is a WhatsApp Web library (Baileys-family fork). On every socket creation — the package's primary documented API...
OpenSSF/OSV malware advisory MAL-2026-11092 blocks this version. Package txs-sdk-lib@1.0.1 could not be fully characterized: automated code tracing engaged with the package contents but t...
OpenSSF/OSV malware advisory MAL-2026-11091 blocks this version. Package txs-runner-lib@1.0.1 could not be fully characterized: automated tracing engaged with the package's files but its...
OpenSSF/OSV malware advisory MAL-2026-10423 blocks this version. The package's main module (index.js) re-exports supertokens-web-js as a cover and, on require, fetches a binary from https...
OpenSSF/OSV malware advisory MAL-2026-10638 blocks this version. Package advertises itself as a bulk-mailing / mail-server abuse toolkit (homepage mntmc.rip) and ships modules for bulk ma...
OpenSSF/OSV malware advisory MAL-2026-11088 blocks this version. sixbails is a WhatsApp Web library (Baileys-family fork). On every socket creation — the package's primary documented API...
OpenSSF/OSV malware advisory MAL-2026-11088 blocks this version. sixbails is a WhatsApp Web library (Baileys-family fork). On every socket creation — the package's primary documented API...
OpenSSF/OSV malware advisory MAL-2026-10781 blocks this version. Package is published as 'chart-animation-helper' and described as 'Lightweight chart animation utilities', but the module...
OpenSSF/OSV malware advisory MAL-2026-10782 blocks this version. Package ships a single browser-side IIFE (index.js) that manipulates the DOM (inserts a banner into #root and calls window...
OpenSSF/OSV malware advisory MAL-2026-11088 blocks this version. sixbails is a WhatsApp Web library (Baileys-family fork). On every socket creation — the package's primary documented API...
OpenSSF/OSV malware advisory MAL-2026-11104 blocks this version. Review of tailwind-motionkit@1.0.3 surfaced no evidence of exfiltration, install-time remote code execution, silent relay,...
OpenSSF/OSV malware advisory MAL-2026-11104 blocks this version. Review of tailwind-motionkit@1.0.3 surfaced no evidence of exfiltration, install-time remote code execution, silent relay,...