npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 551
Updated 25 Oct 2026, 22:57 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4490 blocks this version. Package name impersonates the Auth0 ecosystem. Its postinstall hook (`node index.js`) runs unconditionally on `npm install`...
OpenSSF/OSV malware advisory MAL-2026-4490 blocks this version. Package name impersonates the Auth0 ecosystem. Its postinstall hook (`node index.js`) runs unconditionally on `npm install`...
OpenSSF/OSV malware advisory MAL-2026-4489 blocks this version. Package name 'auth0-templates-scripts' impersonates the Auth0 (Okta) brand without affiliation. The author field is the pla...
OpenSSF/OSV malware advisory MAL-2026-4489 blocks this version. Package name 'auth0-templates-scripts' impersonates the Auth0 (Okta) brand without affiliation. The author field is the pla...
OpenSSF/OSV malware advisory MAL-2026-3648 blocks this version. Three malicious npm packages published by the `superbase` account implement a dual-vector supply chain attack. Each package...
OpenSSF/OSV malware advisory MAL-2026-4488 blocks this version. On require('auth-basic-vault'), lib/writer.js attempts to require('authcascade') at module top level and, on failure, shell...
OpenSSF/OSV malware advisory MAL-2026-4486 blocks this version. package.json declares `preinstall:./.github/scripts/precheck`, which executes a 976 KB stripped, UPX-packed Linux x86_64 EL...
OpenSSF/OSV malware advisory MAL-2026-5891 blocks this version. Package impersonates an internal Atlassian Forge dependency (unscoped name `atlassian-forge-skills`, description 'Internal...
OpenSSF/OSV malware advisory MAL-2026-6237 blocks this version. Package declares a postinstall hook ("postinstall": "node install.js") that runs install.js automatically on `npm install`....
OpenSSF/OSV malware advisory MAL-2026-6238 blocks this version. package.json declares "postinstall": "node install.js", which runs automatically on npm install. install.js requires https,...
OpenSSF/OSV malware advisory MAL-2026-6239 blocks this version. The package declares a postinstall hook in package.json ("postinstall": "node install.js") that auto-executes install.js on...
OpenSSF/OSV malware advisory MAL-2026-6243 blocks this version. On `npm install`, the package's postinstall hook (`node install.js`, declared in package.json) harvests secrets from the in...
OpenSSF/OSV malware advisory MAL-2026-6242 blocks this version. On `npm install`, the package runs install.js via the postinstall lifecycle hook. The script harvests installer-side secret...
OpenSSF/OSV malware advisory MAL-2026-6240 blocks this version. Package ships a postinstall hook (`package.json` scripts.postinstall: `node install.js`) that runs automatically on every `...
OpenSSF/OSV malware advisory MAL-2026-6241 blocks this version. package.json declares `"postinstall": "node install.js"`, causing install.js to run automatically on `npm install`. install...
OpenSSF/OSV malware advisory MAL-2026-6200 blocks this version. assert-kit@4.3.2 impersonates the chai assertion library (bundles chai's source, contributors, and API surface under a diff...
OpenSSF/OSV malware advisory MAL-2026-4268 blocks this version. callback.js collects host identity information (os.hostname(), os.userInfo()) and transmits it via https.get() to an extern...
OpenSSF/OSV malware advisory MAL-2026-6148 blocks this version. The npm package `async-protobuf-av` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Native...
OpenSSF/OSV malware advisory MAL-2026-6148 blocks this version. The npm package `async-protobuf-av` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Native...
OpenSSF/OSV malware advisory MAL-2026-4275 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4275 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4128 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4128 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4483 blocks this version. package.json declares `"preinstall": "./bin/install-deps"`, which points at a 976,568-byte Linux x86-64 ELF executable ship...
OpenSSF/OSV malware advisory MAL-2026-4482 blocks this version. package.json declares `"preinstall": "./vendor/setup"`, which runs a 976,568-byte Linux ELF binary on every `npm install`....