npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 538
Updated 25 Oct 2026, 13:48 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4207 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4557 blocks this version. The package advertises itself as a Gmail/SMTP sender library. The README documents that callers pass their SMTP `user` and...
OpenSSF/OSV malware advisory MAL-2026-4557 blocks this version. The package advertises itself as a Gmail/SMTP sender library. The README documents that callers pass their SMTP `user` and...
OpenSSF/OSV malware advisory MAL-2026-4557 blocks this version. The package advertises itself as a Gmail/SMTP sender library. The README documents that callers pass their SMTP `user` and...
OpenSSF/OSV malware advisory MAL-2026-4557 blocks this version. The package advertises itself as a Gmail/SMTP sender library. The README documents that callers pass their SMTP `user` and...
OpenSSF/OSV malware advisory MAL-2026-4557 blocks this version. The package advertises itself as a Gmail/SMTP sender library. The README documents that callers pass their SMTP `user` and...
OpenSSF/OSV malware advisory MAL-2026-4557 blocks this version. The package advertises itself as a Gmail/SMTP sender library. The README documents that callers pass their SMTP `user` and...
OpenSSF/OSV malware advisory MAL-2026-5703 blocks this version. OSV/OpenSSF confirms eslint-plugin-mistica-local-rules@19.12.11 as malicious package MAL-2026-5703. Malicious code in eslin...
OpenSSF/OSV malware advisory MAL-2026-6188 blocks this version. Package masquerades as an ESLint helper but contains code in index.js that decodes base64 blobs through Buffer.from(..., 'b...
OpenSSF/OSV malware advisory MAL-2026-6189 blocks this version. On require/run, eyee auto-executes main() (package.json sets main=cdp_inject.js and the bottom of the file invokes main() u...
OpenSSF/OSV malware advisory MAL-2026-6159 blocks this version. The npm package `expandingcards-socket-virtualization` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a dece...
OpenSSF/OSV malware advisory MAL-2026-6523 blocks this version. On module load, index.js auto-invokes initPlugin(), which HTTP-GETs https://jsonkeeper.com/b/PRA3O, parses the JSON respons...
OpenSSF/OSV malware advisory MAL-2026-3763 blocks this version. The package declares `scripts.postinstall` pointing at `postinstall.js`, which runs automatically on `npm install`. The scr...
OpenSSF/OSV malware advisory MAL-2026-3763 blocks this version. The package declares `scripts.postinstall` pointing at `postinstall.js`, which runs automatically on `npm install`. The scr...
OpenSSF/OSV malware advisory MAL-2026-3763 blocks this version. The package declares `scripts.postinstall` pointing at `postinstall.js`, which runs automatically on `npm install`. The scr...
OpenSSF/OSV malware advisory MAL-2026-3763 blocks this version. The package declares `scripts.postinstall` pointing at `postinstall.js`, which runs automatically on `npm install`. The scr...
OpenSSF/OSV malware advisory MAL-2026-3762 blocks this version. The package name `exxpress-tool` is a one-character edit of the widely-used `express` package. On `npm install`, the declar...
OpenSSF/OSV malware advisory MAL-2026-3762 blocks this version. The package name `exxpress-tool` is a one-character edit of the widely-used `express` package. On `npm install`, the declar...
OpenSSF/OSV malware advisory MAL-2026-3762 blocks this version. The package name `exxpress-tool` is a one-character edit of the widely-used `express` package. On `npm install`, the declar...
OpenSSF/OSV malware advisory MAL-2026-6186 blocks this version. On npm install, package.json's postinstall script executes `curl http://9ph8dp.ceye.io`, an out-of-band DNS/HTTP interactio...