npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 537
Updated 25 Oct 2026, 13:08 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3761 blocks this version. The package's npm postinstall hook executes a one-liner that uses child_process.exec to curl/wget an unpinned Python script...
OpenSSF/OSV malware advisory MAL-2026-3720 blocks this version. The OpenSSF Package Analysis project identified 'ethers-wordlist' @ 1.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-3711 blocks this version. The OpenSSF Package Analysis project identified 'ethers-web' @ 1.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-3710 blocks this version. The OpenSSF Package Analysis project identified 'ethers-logger' @ 1.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-3709 blocks this version. The OpenSSF Package Analysis project identified 'ethers-json-wallet' @ 1.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-3707 blocks this version. package.json declares a postinstall hook that base64-decodes the URL http://8.217.75.147:3000/payload, fetches it via curl...
OpenSSF/OSV malware advisory MAL-2026-3707 blocks this version. package.json declares a postinstall hook that base64-decodes the URL http://8.217.75.147:3000/payload, fetches it via curl...
OpenSSF/OSV malware advisory MAL-2026-3708 blocks this version. The package's `package.json` declares a `postinstall` script that base64-decodes a hidden URL (`http://8.217.75.147:3000/pa...
OpenSSF/OSV malware advisory MAL-2026-3708 blocks this version. The package's `package.json` declares a `postinstall` script that base64-decodes a hidden URL (`http://8.217.75.147:3000/pa...
OpenSSF/OSV malware advisory MAL-2026-3760 blocks this version. On `npm install`, the package's postinstall hook spawns a Node one-liner that uses child_process.exec to curl/wget `https:/...
OpenSSF/OSV malware advisory MAL-2026-4240 blocks this version. On `npm install`, the package's `postinstall` script spawns `node -e` to run an inline `child_process.execSync` that curls...
OpenSSF/OSV malware advisory MAL-2026-4239 blocks this version. package.json declares a postinstall script that performs an HTTPS GET to an ephemeral pinggy-free.link tunnel URL (rqnyz-26...
OpenSSF/OSV malware advisory MAL-2026-6202 blocks this version. index.js line 144 contains `require('chai-assert-kit')` appended after the module's normal exports, with no other reference...
OpenSSF/OSV malware advisory MAL-2026-4779 blocks this version. Package name 'ether-bn.js' resembles the widely-used 'bn.js' big-number library, and the README directs users to install ye...
OpenSSF/OSV malware advisory MAL-2026-4779 blocks this version. Package name 'ether-bn.js' resembles the widely-used 'bn.js' big-number library, and the README directs users to install ye...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...