npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 538
Updated 24 Oct 2026, 12:52 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6482 blocks this version. On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: i...
OpenSSF/OSV malware advisory MAL-2026-11089 blocks this version. No concrete installer-harm signals were identified in this version. Package name suggests transaction-building functionali...
OpenSSF/OSV malware advisory MAL-2026-6437 blocks this version. On npm install, scripts/install-check.cjs (registered as a postinstall lifecycle script) fetches a JSON config from a hardc...
OpenSSF/OSV malware advisory MAL-2026-6437 blocks this version. On npm install, scripts/install-check.cjs (registered as a postinstall lifecycle script) fetches a JSON config from a hardc...
OpenSSF/OSV malware advisory MAL-2026-6437 blocks this version. On npm install, scripts/install-check.cjs (registered as a postinstall lifecycle script) fetches a JSON config from a hardc...
OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...
OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...
OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...
OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...
OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...
OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...
OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...
OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...
OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...
OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...
OpenSSF/OSV malware advisory MAL-2026-11328 blocks this version. Package name 'logform-core' is one edit/suffix away from the widely-used 'logform' logging-format library, and the README...
OpenSSF/OSV malware advisory MAL-2026-11328 blocks this version. Package name 'logform-core' is one edit/suffix away from the widely-used 'logform' logging-format library, and the README...
OpenSSF/OSV malware advisory MAL-2026-11328 blocks this version. Package name 'logform-core' is one edit/suffix away from the widely-used 'logform' logging-format library, and the README...
OpenSSF/OSV malware advisory MAL-2026-11088 blocks this version. sixbails is a WhatsApp Web library (Baileys-family fork). On every socket creation — the package's primary documented API...
OpenSSF/OSV malware advisory MAL-2026-6438 blocks this version. The package ships a `postinstall` hook (`scripts/sync-peer.cjs`) that runs on every default `npm install`. The script compa...
OpenSSF/OSV malware advisory MAL-2026-6438 blocks this version. The package ships a `postinstall` hook (`scripts/sync-peer.cjs`) that runs on every default `npm install`. The script compa...
OpenSSF/OSV malware advisory MAL-2026-6438 blocks this version. The package ships a `postinstall` hook (`scripts/sync-peer.cjs`) that runs on every default `npm install`. The script compa...
OpenSSF/OSV malware advisory MAL-2026-6438 blocks this version. The package ships a `postinstall` hook (`scripts/sync-peer.cjs`) that runs on every default `npm install`. The script compa...
OpenSSF/OSV malware advisory MAL-2026-10638 blocks this version. Package advertises itself as a bulk-mailing / mail-server abuse toolkit (homepage mntmc.rip) and ships modules for bulk ma...
OpenSSF/OSV malware advisory MAL-2026-11081 blocks this version. Package name `amanexzyra-baileys` resembles the popular WhatsApp Web API library `@whiskeysockets/baileys` family, which h...