npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 553
Updated 24 Oct 2026, 21:26 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-11791 blocks this version. npm/@qlik/embed-svelte is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hul...
OpenSSF/OSV malware advisory MAL-2026-11797 blocks this version. npm/@qlik/eslint-config-vue is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sha...
OpenSSF/OSV malware advisory MAL-2026-11790 blocks this version. npm/@qlik/embed-runtime is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hu...
OpenSSF/OSV malware advisory MAL-2026-11796 blocks this version. npm/@qlik/eslint-config-svelte is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "...
OpenSSF/OSV malware advisory MAL-2026-11788 blocks this version. npm/@qlik/dts-bundler is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulu...
OpenSSF/OSV malware advisory MAL-2026-11794 blocks this version. npm/@qlik/eslint-config-base is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...
OpenSSF/OSV malware advisory MAL-2026-11792 blocks this version. npm/@qlik/embed-web-components is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "...
OpenSSF/OSV malware advisory MAL-2026-11785 blocks this version. npm/@qlik/carbon-core is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulu...
OpenSSF/OSV malware advisory MAL-2026-11787 blocks this version. npm/@qlik/design-tokens is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hu...
OpenSSF/OSV malware advisory MAL-2026-11805 blocks this version. npm/@qlik/sprout-design-docs is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...
OpenSSF/OSV malware advisory MAL-2026-11800 blocks this version. npm/@qlik/oxlint-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hu...
OpenSSF/OSV malware advisory MAL-2026-11784 blocks this version. npm/@qlik/browserslist-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "S...
OpenSSF/OSV malware advisory MAL-2026-11789 blocks this version. npm/@qlik/embed-react is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulu...
OpenSSF/OSV malware advisory MAL-2026-11782 blocks this version. npm/@picsart/gen-ai is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud:...
OpenSSF/OSV malware advisory MAL-2026-11781 blocks this version. npm/@picsart/ai-sdk is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud:...
OpenSSF/OSV malware advisory MAL-2026-11832 blocks this version. npm/@servicetitan/carto-charts-core is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (...
OpenSSF/OSV malware advisory MAL-2026-11820 blocks this version. npm/@servicetitan/anvil-themes is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "...
OpenSSF/OSV malware advisory MAL-2026-11821 blocks this version. npm/@servicetitan/anvil-token is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "S...
OpenSSF/OSV malware advisory MAL-2026-11823 blocks this version. npm/@servicetitan/anvil2-codemods is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (th...
OpenSSF/OSV malware advisory MAL-2026-11824 blocks this version. npm/@servicetitan/anvil2-ext-atlas is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (t...
OpenSSF/OSV malware advisory MAL-2026-11836 blocks this version. npm/@servicetitan/carto-rn-kit is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "...
OpenSSF/OSV malware advisory MAL-2026-11818 blocks this version. npm/@servicetitan/anvil-icons is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "S...
OpenSSF/OSV malware advisory MAL-2026-11814 blocks this version. npm/@servicetitan/ajax-handlers is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11827 blocks this version. npm/@servicetitan/anvil2-ext-mwv is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11816 blocks this version. npm/@servicetitan/anvil-fonts is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "S...