npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 544
Updated 24 Oct 2026, 16:09 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-12076 blocks this version. The package advertises itself as an in-memory cache utility, but index.js unconditionally requires _compat.js on load, whi...
OpenSSF/OSV malware advisory MAL-2026-12060 blocks this version. Package advertises itself as a React UI component library but index.js requires./setup.js, which schedules bootstrap() on...
OpenSSF/OSV malware advisory MAL-2026-12059 blocks this version. The package presents itself as an ESLint config / 'environment config reader' but on require() executes an import-time dro...
OpenSSF/OSV malware advisory MAL-2026-12060 blocks this version. Package advertises itself as a React UI component library but index.js requires./setup.js, which schedules bootstrap() on...
OpenSSF/OSV malware advisory MAL-2026-12059 blocks this version. The package presents itself as an ESLint config / 'environment config reader' but on require() executes an import-time dro...
OpenSSF/OSV malware advisory MAL-2026-12059 blocks this version. The package presents itself as an ESLint config / 'environment config reader' but on require() executes an import-time dro...
OpenSSF/OSV malware advisory MAL-2026-12060 blocks this version. Package advertises itself as a React UI component library but index.js requires./setup.js, which schedules bootstrap() on...
OpenSSF/OSV malware advisory MAL-2026-12065 blocks this version. greatcall-customers-commandapi@99.0.0 is a dependency-confusion attack package. package.json self-describes as "Dependency...
OpenSSF/OSV malware advisory MAL-2026-11752 blocks this version. npm/@ornikar/eslint-config-typescript-nestjs is affected by the large-scale, self-propagating npm supply-chain worm of 202...
OpenSSF/OSV malware advisory MAL-2026-11751 blocks this version. npm/@ornikar/eslint-config-typescript is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04...
OpenSSF/OSV malware advisory MAL-2026-11777 blocks this version. npm/@ornikar/storybook-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "S...
OpenSSF/OSV malware advisory MAL-2026-11764 blocks this version. npm/@ornikar/monorepo-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...
OpenSSF/OSV malware advisory MAL-2026-11760 blocks this version. npm/@ornikar/jest-config-react-native is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04...
OpenSSF/OSV malware advisory MAL-2026-11771 blocks this version. npm/@ornikar/repo-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-H...
OpenSSF/OSV malware advisory MAL-2026-11754 blocks this version. npm/@ornikar/eslint-plugin-neverthrow is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04...
OpenSSF/OSV malware advisory MAL-2026-11763 blocks this version. npm/@ornikar/lerna-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-...
OpenSSF/OSV malware advisory MAL-2026-11772 blocks this version. npm/@ornikar/repo-config-react is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "...
OpenSSF/OSV malware advisory MAL-2026-11776 blocks this version. npm/@ornikar/slate-react-fork is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "S...
OpenSSF/OSV malware advisory MAL-2026-11768 blocks this version. npm/@ornikar/react-modern-calendar-datepicker is affected by the large-scale, self-propagating npm supply-chain worm of 20...
OpenSSF/OSV malware advisory MAL-2026-11755 blocks this version. npm/@ornikar/eslint-plugin-ornikar is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (t...
OpenSSF/OSV malware advisory MAL-2026-11774 blocks this version. npm/@ornikar/rollup-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai...
OpenSSF/OSV malware advisory MAL-2026-11748 blocks this version. npm/@ornikar/eslint-config-formatjs is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (...
OpenSSF/OSV malware advisory MAL-2026-11762 blocks this version. npm/@ornikar/kitt2 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud:...
OpenSSF/OSV malware advisory MAL-2026-11756 blocks this version. npm/@ornikar/graphql-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sha...
OpenSSF/OSV malware advisory MAL-2026-11780 blocks this version. npm/@ornikar/webpack-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sha...