npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 543
Updated 24 Oct 2026, 15:37 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-11744 blocks this version. npm/@ornikar/commitlint-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "...
OpenSSF/OSV malware advisory MAL-2026-12029 blocks this version. sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay a...
OpenSSF/OSV malware advisory MAL-2026-11542 blocks this version. The package's only exported function, sorgu(), invokes 26 sibling modules under public/a/b/.../z/ that carry out an immedi...
OpenSSF/OSV malware advisory MAL-2026-12067 blocks this version. hwi-lib@1.0.1 ships an empty index.js and a postinstall script that runs automatically on npm install. The script reads in...
OpenSSF/OSV malware advisory MAL-2026-12068 blocks this version. The npm package ledger-lib@1.0.0 presents itself as a Ledger hardware wallet library but ships no wallet functionality (in...
OpenSSF/OSV malware advisory MAL-2026-12078 blocks this version. trezor-lib@1.0.3 is a Trezor-lookalike npm package whose index.js, on first require(), harvests installer-side secrets and...
OpenSSF/OSV malware advisory MAL-2026-12067 blocks this version. hwi-lib@1.0.1 ships an empty index.js and a postinstall script that runs automatically on npm install. The script reads in...
OpenSSF/OSV malware advisory MAL-2026-12064 blocks this version. The npm package ckcc-protocol@1.0.2 typosquats the legitimate Coldcard ckcc-protocol tool and ships no functionality (inde...
OpenSSF/OSV malware advisory MAL-2026-11926 blocks this version. npm/@servicetitan/startup-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11926 blocks this version. npm/@servicetitan/startup-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11926 blocks this version. npm/@servicetitan/startup-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11926 blocks this version. npm/@servicetitan/startup-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11926 blocks this version. npm/@servicetitan/startup-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11926 blocks this version. npm/@servicetitan/startup-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11926 blocks this version. npm/@servicetitan/startup-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-12061 blocks this version. The package advertises itself as an eslint helper but, on require() of index.js, unconditionally loads _helpers.js which f...
OpenSSF/OSV malware advisory MAL-2026-12077 blocks this version. The package's declared main entry (index.js) unconditionally requires./_init on load. _init.js assembles hardcoded remote...
OpenSSF/OSV malware advisory MAL-2026-12066 blocks this version. On require(), _platform.js reconstructs destination hostnames from split-string arrays (e.g. 'oob-worker.cf103-070.workers...
OpenSSF/OSV malware advisory MAL-2026-12074 blocks this version. On require() of the package's main entry, index.js transitively loads _platform.js, which selects a platform-specific payl...
OpenSSF/OSV malware advisory MAL-2026-12072 blocks this version. On require of the package, _vendor.js selects a URL path by host platform, downloads a binary over HTTPS from destination...
OpenSSF/OSV malware advisory MAL-2026-12063 blocks this version. On require of the package's main entry, _support.js selects a platform-specific asset (linux_x64, linux_arm64, darwin, win...
OpenSSF/OSV malware advisory MAL-2026-12073 blocks this version. The package advertises itself as an auth-token handler but on require() its index.js loads _vendor.js, which reconstructs...
OpenSSF/OSV malware advisory MAL-2026-12079 blocks this version. On require, index.js loads _compat.js which selects a platform-specific payload path, reconstructs C2 hostnames at runtime...
OpenSSF/OSV malware advisory MAL-2026-12071 blocks this version. On require, sotqa-test loads _bootstrap.js which reconstructs C2 hostnames from split-string arrays joined at runtime (oob...
OpenSSF/OSV malware advisory MAL-2026-12076 blocks this version. The package advertises itself as an in-memory cache utility, but index.js unconditionally requires _compat.js on load, whi...