npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 552
Updated 24 Oct 2026, 20:58 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-11756 blocks this version. npm/@ornikar/graphql-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sha...
OpenSSF/OSV malware advisory MAL-2026-11776 blocks this version. npm/@ornikar/slate-react-fork is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "S...
OpenSSF/OSV malware advisory MAL-2026-11762 blocks this version. npm/@ornikar/kitt2 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud:...
OpenSSF/OSV malware advisory MAL-2026-11755 blocks this version. npm/@ornikar/eslint-plugin-ornikar is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (t...
OpenSSF/OSV malware advisory MAL-2026-11769 blocks this version. npm/@ornikar/react-native-svg-transformer is affected by the large-scale, self-propagating npm supply-chain worm of 2026-0...
OpenSSF/OSV malware advisory MAL-2026-11780 blocks this version. npm/@ornikar/webpack-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sha...
OpenSSF/OSV malware advisory MAL-2026-11774 blocks this version. npm/@ornikar/rollup-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai...
OpenSSF/OSV malware advisory MAL-2026-11752 blocks this version. npm/@ornikar/eslint-config-typescript-nestjs is affected by the large-scale, self-propagating npm supply-chain worm of 202...
OpenSSF/OSV malware advisory MAL-2026-11754 blocks this version. npm/@ornikar/eslint-plugin-neverthrow is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04...
OpenSSF/OSV malware advisory MAL-2026-11763 blocks this version. npm/@ornikar/lerna-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-...
OpenSSF/OSV malware advisory MAL-2026-11772 blocks this version. npm/@ornikar/repo-config-react is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "...
OpenSSF/OSV malware advisory MAL-2026-11761 blocks this version. npm/@ornikar/jest-config-react-native-web is affected by the large-scale, self-propagating npm supply-chain worm of 2026-0...
OpenSSF/OSV malware advisory MAL-2026-11766 blocks this version. npm/@ornikar/prettier-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...
OpenSSF/OSV malware advisory MAL-2026-12058 blocks this version. postinstall.js runs unconditionally on npm install and harvests installer-side secrets before transmitting them off-host....
OpenSSF/OSV malware advisory MAL-2026-12057 blocks this version. The package @zzzgenesis00/playwrite is a typosquat of playwright. Its exported launch() returns empty stub methods, while...
OpenSSF/OSV malware advisory MAL-2026-12056 blocks this version. On npm install, postinstall.js executes and enumerates installer-side secrets: files under ~/.ssh (non-.pub private keys),...
OpenSSF/OSV malware advisory MAL-2026-12055 blocks this version. postinstall.js runs automatically on npm install and enumerates installer-side secret stores including ~/.ssh, ~/.npmrc, ~...
OpenSSF/OSV malware advisory MAL-2026-11783 blocks this version. npm/@qlik/api is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud: Here...
OpenSSF/OSV malware advisory MAL-2026-11804 blocks this version. npm/@qlik/sdk is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud: Here...
OpenSSF/OSV malware advisory MAL-2026-11802 blocks this version. npm/@qlik/react-native-simple-grid is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (t...
OpenSSF/OSV malware advisory MAL-2026-11798 blocks this version. npm/@qlik/nebula-table-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...
OpenSSF/OSV malware advisory MAL-2026-11803 blocks this version. npm/@qlik/runtime-module-loader is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11799 blocks this version. npm/@qlik/oxfmt-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hul...
OpenSSF/OSV malware advisory MAL-2026-11795 blocks this version. npm/@qlik/eslint-config-react is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "S...
OpenSSF/OSV malware advisory MAL-2026-11801 blocks this version. npm/@qlik/prettier-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-...