npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 548
Updated 25 Oct 2026, 20:34 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3758 blocks this version. Package name `dotenvv-tool` impersonates the popular `dotenv` package; index.js is an admitted dummy stub ("The real payloa...
OpenSSF/OSV malware advisory MAL-2026-3758 blocks this version. Package name `dotenvv-tool` impersonates the popular `dotenv` package; index.js is an admitted dummy stub ("The real payloa...
OpenSSF/OSV malware advisory MAL-2026-3758 blocks this version. Package name `dotenvv-tool` impersonates the popular `dotenv` package; index.js is an admitted dummy stub ("The real payloa...
OpenSSF/OSV malware advisory MAL-2026-3758 blocks this version. Package name `dotenvv-tool` impersonates the popular `dotenv` package; index.js is an admitted dummy stub ("The real payloa...
OpenSSF/OSV malware advisory MAL-2026-4549 blocks this version. On every import, dist/index.js base64-decodes a hardcoded AES-256-CBC ciphertext, derives a key from environment variable V...
OpenSSF/OSV malware advisory MAL-2026-4549 blocks this version. On every import, dist/index.js base64-decodes a hardcoded AES-256-CBC ciphertext, derives a key from environment variable V...
OpenSSF/OSV malware advisory MAL-2026-4549 blocks this version. On every import, dist/index.js base64-decodes a hardcoded AES-256-CBC ciphertext, derives a key from environment variable V...
OpenSSF/OSV malware advisory MAL-2026-5826 blocks this version. OSV/OpenSSF confirms dms-backend@1.0.0 as malicious package MAL-2026-5826. Malicious code in dms-backend (npm)
OpenSSF/OSV malware advisory MAL-2026-6481 blocks this version. Package published at version 99.99.99 under the gx-npm-* namespace, a shape designed to win npm version resolution against...
OpenSSF/OSV malware advisory MAL-2026-6466 blocks this version. gx-npm-feature-flags@99.99.99 is a dependency-confusion squat (max-semver `99.99.99` on a `gx-`-prefixed name to outrank a...
OpenSSF/OSV malware advisory MAL-2026-6480 blocks this version. Package published at version 99.99.99 under a generic name (`gx-npm-lib`) — the canonical dependency-confusion shape used t...
OpenSSF/OSV malware advisory MAL-2026-3310 blocks this version. The package gweb-build-system was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-5612 blocks this version. OSV/OpenSSF confirms gpt-sdk@0.2.4 as malicious package MAL-2026-5612. Malicious code in gpt-sdk (npm)
OpenSSF/OSV malware advisory MAL-2026-5612 blocks this version. OSV/OpenSSF confirms gpt-sdk@0.2.3 as malicious package MAL-2026-5612. Malicious code in gpt-sdk (npm)
OpenSSF/OSV malware advisory MAL-2026-5612 blocks this version. OSV/OpenSSF confirms gpt-sdk@0.2.2 as malicious package MAL-2026-5612. Malicious code in gpt-sdk (npm)
OpenSSF/OSV malware advisory MAL-2026-5612 blocks this version. OSV/OpenSSF confirms gpt-sdk@0.2.1 as malicious package MAL-2026-5612. Malicious code in gpt-sdk (npm)
OpenSSF/OSV malware advisory MAL-2026-5612 blocks this version. OSV/OpenSSF confirms gpt-sdk@0.2.0 as malicious package MAL-2026-5612. Malicious code in gpt-sdk (npm)
OpenSSF/OSV malware advisory MAL-2026-5612 blocks this version. OSV/OpenSSF confirms gpt-sdk@0.1.3 as malicious package MAL-2026-5612. Malicious code in gpt-sdk (npm)
OpenSSF/OSV malware advisory MAL-2026-5612 blocks this version. OSV/OpenSSF confirms gpt-sdk@0.1.2 as malicious package MAL-2026-5612. Malicious code in gpt-sdk (npm)
OpenSSF/OSV malware advisory MAL-2026-5612 blocks this version. OSV/OpenSSF confirms gpt-sdk@0.1.1 as malicious package MAL-2026-5612. Malicious code in gpt-sdk (npm)
OpenSSF/OSV malware advisory MAL-2026-5612 blocks this version. OSV/OpenSSF confirms gpt-sdk@0.1.0 as malicious package MAL-2026-5612. Malicious code in gpt-sdk (npm)
OpenSSF/OSV malware advisory MAL-2026-6375 blocks this version. collect.js bundles a host-reconnaissance and exfiltration payload. It loads child_process, fs, os, http, and https, reads o...
OpenSSF/OSV malware advisory MAL-2026-6375 blocks this version. collect.js bundles a host-reconnaissance and exfiltration payload. It loads child_process, fs, os, http, and https, reads o...
OpenSSF/OSV malware advisory MAL-2026-6537 blocks this version. On `npm install`, the package's preinstall lifecycle script (preinstall.js, declared via scripts.preinstall "node preinstal...
OpenSSF/OSV malware advisory MAL-2026-6537 blocks this version. On `npm install`, the package's preinstall lifecycle script (preinstall.js, declared via scripts.preinstall "node preinstal...