npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 550
Updated 25 Oct 2026, 22:15 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3504 blocks this version. The package git-git-git was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3504 blocks this version. The package git-git-git was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3504 blocks this version. The package git-git-git was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4243 blocks this version. Package name impersonates the widely-used ganache-cli Ethereum development tool but ships only a 138-byte index.js stub tha...
OpenSSF/OSV malware advisory MAL-2026-4135 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4135 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-5641 blocks this version. OSV/OpenSSF confirms goreleaser-run@2.16.1 as malicious package MAL-2026-5641. Malicious code in goreleaser-run (npm)
OpenSSF/OSV malware advisory MAL-2026-5641 blocks this version. OSV/OpenSSF confirms goreleaser-run@2.16.0 as malicious package MAL-2026-5641. Malicious code in goreleaser-run (npm)
OpenSSF/OSV malware advisory MAL-2026-3260 blocks this version. Dependency confusion and typosquatting campaign by threat actor "saif777". Packages use inflated version numbers (9999.9999...
OpenSSF/OSV malware advisory MAL-2026-3309 blocks this version. Malicious npm package published by the `microsop` threat actor as part of a dependency-confusion campaign that impersonates...
OpenSSF/OSV malware advisory MAL-2026-4574 blocks this version. package.json declares an `install` lifecycle script that runs `bin/gm-kilo.js install`. At install time, the script execute...
OpenSSF/OSV malware advisory MAL-2026-4487 blocks this version. The package's postinstall script executes shell reconnaissance (`id || ver && whoami && hostname`), fetches the installer's...
OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...
OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...
OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...
OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...
OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...
OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...
OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...
OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...
OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...
OpenSSF/OSV malware advisory MAL-2026-4491 blocks this version. On require('authcascade'), the package's main entry pino.js loads lib/writer.js which (a) builds a data object containing t...
OpenSSF/OSV malware advisory MAL-2026-4491 blocks this version. On require('authcascade'), the package's main entry pino.js loads lib/writer.js which (a) builds a data object containing t...
OpenSSF/OSV malware advisory MAL-2024-1783 blocks this version. OSV/OpenSSF confirms auth0.net@7.22.1 as malicious package MAL-2024-1783. Malicious code in auth0.net (npm)
OpenSSF/OSV malware advisory MAL-2024-1783 blocks this version. OSV/OpenSSF confirms auth0.net@39.1.0 as malicious package MAL-2024-1783. Malicious code in auth0.net (npm)