npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 543
Updated 25 Oct 2026, 17:23 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...
OpenSSF/OSV malware advisory MAL-2026-4564 blocks this version. dist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry proj...
OpenSSF/OSV malware advisory MAL-2026-4563 blocks this version. The package ships a single heavily-obfuscated cli.obf.js (RC4 string-array via javascript-obfuscator, per the prepublishOnl...
OpenSSF/OSV malware advisory MAL-2026-4563 blocks this version. The package ships a single heavily-obfuscated cli.obf.js (RC4 string-array via javascript-obfuscator, per the prepublishOnl...
OpenSSF/OSV malware advisory MAL-2026-4563 blocks this version. The package ships a single heavily-obfuscated cli.obf.js (RC4 string-array via javascript-obfuscator, per the prepublishOnl...
OpenSSF/OSV malware advisory MAL-2026-4133 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4133 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4134 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4134 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-3140 blocks this version. The package fivem-monitor was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4558 blocks this version. The package is an AI agent policy-check plugin. When a consumer does not configure their own API key, resolveApiKey() retur...
OpenSSF/OSV malware advisory MAL-2026-6255 blocks this version. package.json declares a preinstall lifecycle hook (`"preinstall": "node index.js"`) that runs index.js on every `npm instal...
OpenSSF/OSV malware advisory MAL-2026-6255 blocks this version. package.json declares a preinstall lifecycle hook (`"preinstall": "node index.js"`) that runs index.js on every `npm instal...
OpenSSF/OSV malware advisory MAL-2026-6255 blocks this version. package.json declares a preinstall lifecycle hook (`"preinstall": "node index.js"`) that runs index.js on every `npm instal...
OpenSSF/OSV malware advisory MAL-2026-6162 blocks this version. The npm package `font-picker-responsive` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Na...
OpenSSF/OSV malware advisory MAL-2026-6162 blocks this version. The npm package `font-picker-responsive` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Na...
OpenSSF/OSV malware advisory MAL-2026-4241 blocks this version. package.json declares a postinstall hook that runs `node -e` with an inline child_process.execSync invoking `curl -fsSL rqn...
OpenSSF/OSV malware advisory MAL-2026-4242 blocks this version. On `npm install`, the package's postinstall script runs an inline `node -e` that shells out to `curl -fsSL` against an ephe...
OpenSSF/OSV malware advisory MAL-2026-6092 blocks this version. Package declares a postinstall lifecycle hook ("postinstall": "node run.js" in package.json) that runs run.js automatically...
OpenSSF/OSV malware advisory MAL-2026-6514 blocks this version. package.json declares a postinstall lifecycle script that auto-executes on `npm install`. The hook performs a recursive fil...
OpenSSF/OSV malware advisory MAL-2026-6514 blocks this version. package.json declares a postinstall lifecycle script that auto-executes on `npm install`. The hook performs a recursive fil...
OpenSSF/OSV malware advisory MAL-2026-6513 blocks this version. package.json declares a postinstall script that runs automatically on `npm install`. The script performs filesystem reconna...
OpenSSF/OSV malware advisory MAL-2026-6498 blocks this version. package.json declares a postinstall script that runs automatically on npm install. The script walks the entire filesystem w...
OpenSSF/OSV malware advisory MAL-2026-6498 blocks this version. package.json declares a postinstall script that runs automatically on npm install. The script walks the entire filesystem w...