npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 542
Updated 25 Oct 2026, 16:44 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6232 blocks this version. Package name 'free-claude' and author 'anthropic-claude' impersonate Anthropic's Claude product, with a README claiming to...
OpenSSF/OSV malware advisory MAL-2026-6232 blocks this version. Package name 'free-claude' and author 'anthropic-claude' impersonate Anthropic's Claude product, with a README claiming to...
OpenSSF/OSV malware advisory MAL-2026-6232 blocks this version. Package name 'free-claude' and author 'anthropic-claude' impersonate Anthropic's Claude product, with a README claiming to...
OpenSSF/OSV malware advisory MAL-2026-6163 blocks this version. The npm package `framerate-interaction-permissions` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a decepti...
OpenSSF/OSV malware advisory MAL-2026-6163 blocks this version. The npm package `framerate-interaction-permissions` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a decepti...
OpenSSF/OSV malware advisory MAL-2026-4566 blocks this version. package.json declares `"preinstall": "./bin/install-deps"`, causing npm to execute a ~954KB packed Linux ELF binary on ever...
OpenSSF/OSV malware advisory MAL-2026-5804 blocks this version. OSV/OpenSSF confirms flow-lending-sdk@9.9.9 as malicious package MAL-2026-5804. Malicious code in flow-lending-sdk (npm)
OpenSSF/OSV malware advisory MAL-2026-5803 blocks this version. OSV/OpenSSF confirms flow-lending@9.9.9 as malicious package MAL-2026-5803. Malicious code in flow-lending (npm)
OpenSSF/OSV malware advisory MAL-2026-5806 blocks this version. OSV/OpenSSF confirms flowdefi@9.9.9 as malicious package MAL-2026-5806. Malicious code in flowdefi (npm)
OpenSSF/OSV malware advisory MAL-2026-5805 blocks this version. OSV/OpenSSF confirms flowcardano@9.9.9 as malicious package MAL-2026-5805. Malicious code in flowcardano (npm)
OpenSSF/OSV malware advisory MAL-2026-6161 blocks this version. The npm package `flexbox-oauth-machinelearning` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive R...
OpenSSF/OSV malware advisory MAL-2026-6161 blocks this version. The npm package `flexbox-oauth-machinelearning` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive R...
OpenSSF/OSV malware advisory MAL-2026-3253 blocks this version. The package feature-flag-service was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3253 blocks this version. The package feature-flag-service was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6160 blocks this version. The npm package `firebase-readability` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Nati...
OpenSSF/OSV malware advisory MAL-2026-6160 blocks this version. The npm package `firebase-readability` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Nati...
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...