npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 537
Updated 24 Oct 2026, 12:21 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-10782 blocks this version. Package ships a single browser-side IIFE (index.js) that manipulates the DOM (inserts a banner into #root and calls window...
OpenSSF/OSV malware advisory MAL-2026-11088 blocks this version. sixbails is a WhatsApp Web library (Baileys-family fork). On every socket creation — the package's primary documented API...
OpenSSF/OSV malware advisory MAL-2026-11104 blocks this version. Review of tailwind-motionkit@1.0.3 surfaced no evidence of exfiltration, install-time remote code execution, silent relay,...
OpenSSF/OSV malware advisory MAL-2026-11104 blocks this version. Review of tailwind-motionkit@1.0.3 surfaced no evidence of exfiltration, install-time remote code execution, silent relay,...
OpenSSF/OSV malware advisory MAL-2026-11088 blocks this version. sixbails is a WhatsApp Web library (Baileys-family fork). On every socket creation — the package's primary documented API...
OpenSSF/OSV malware advisory MAL-2026-11023 blocks this version. Package `bs58-88` mimics the popular `bs58` base58 encoder: README, keywords, and repository URL match the real `bs58`, an...
OpenSSF/OSV malware advisory MAL-2026-6482 blocks this version. LPM AI assessed this version as clean; the assessments disagree. On npm install, scripts/install-check.cjs runs as a postin...
OpenSSF/OSV malware advisory MAL-2026-10498 blocks this version. package.json declares a preinstall lifecycle script that runs curl against the hardcoded bare IP http://109.71.252.153:808...
OpenSSF/OSV malware advisory MAL-2026-6702 blocks this version. vue-demi-fix is a name-confusion package against the widely used vue-demi library. package.json declares both preinstall an...
OpenSSF/OSV malware advisory MAL-2026-6712 blocks this version. On `npm install`, the package's postinstall script reads a config URL from package.json's `homepage` field (https://parket-...
OpenSSF/OSV malware advisory MAL-2026-11029 blocks this version. lychee-norm-cache is a dependency-confusion proof-of-concept that provides no functional utility. Its bin script POSTs a s...
OpenSSF/OSV malware advisory MAL-2026-11025 blocks this version. No a static rule matches and no behavioral findings were produced for this package version. With no evidence of exfiltrati...
OpenSSF/OSV malware advisory MAL-2026-11025 blocks this version. No a static rule matches and no behavioral findings were produced for this package version. With no evidence of exfiltrati...
OpenSSF/OSV malware advisory MAL-2026-10498 blocks this version. package.json declares a preinstall lifecycle script that runs curl against the hardcoded bare IP http://109.71.252.153:808...
OpenSSF/OSV malware advisory MAL-2026-11028 blocks this version. No a static rule matches and no behavioral findings of concern were identified for helix-deploy@110.0.1. No install-time l...
OpenSSF/OSV malware advisory MAL-2026-11028 blocks this version. No a static rule matches and no behavioral findings of concern were identified for helix-deploy@110.0.1. No install-time l...
OpenSSF/OSV malware advisory MAL-2026-11081 blocks this version. Package name `amanexzyra-baileys` resembles the popular WhatsApp Web API library `@whiskeysockets/baileys` family, which h...
OpenSSF/OSV malware advisory MAL-2026-11088 blocks this version. sixbails is a WhatsApp Web library (Baileys-family fork). On every socket creation — the package's primary documented API...
OpenSSF/OSV malware advisory MAL-2026-6702 blocks this version. vue-demi-fix is a name-confusion package against the widely used vue-demi library. package.json declares both preinstall an...
OpenSSF/OSV malware advisory MAL-2026-6702 blocks this version. vue-demi-fix is a name-confusion package against the widely used vue-demi library. package.json declares both preinstall an...
OpenSSF/OSV malware advisory MAL-2026-6702 blocks this version. vue-demi-fix is a name-confusion package against the widely used vue-demi library. package.json declares both preinstall an...
OpenSSF/OSV malware advisory MAL-2026-6482 blocks this version. On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: i...
OpenSSF/OSV malware advisory MAL-2026-6482 blocks this version. On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: i...
OpenSSF/OSV malware advisory MAL-2026-6482 blocks this version. On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: i...
OpenSSF/OSV malware advisory MAL-2026-11089 blocks this version. No concrete installer-harm signals were identified in this version. Package name suggests transaction-building functionali...