npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 554
Updated 26 Oct 2026, 01:09 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4348 blocks this version. A campaign of npm packages sharing a common dropper (`clob.js`) that downloads and persistently installs a Windows executab...
OpenSSF/OSV malware advisory MAL-2026-4348 blocks this version. A campaign of npm packages sharing a common dropper (`clob.js`) that downloads and persistently installs a Windows executab...
OpenSSF/OSV malware advisory MAL-2026-3819 blocks this version. The package apexpro-node was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3234 blocks this version. The package apexpro was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3234 blocks this version. The package apexpro was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3818 blocks this version. The package apexomni-node was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3233 blocks this version. The package apexomni was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3816 blocks this version. The package apex-connector was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3817 blocks this version. The package apex-trading was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3304 blocks this version. The package apcyber-test-package was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3304 blocks this version. The package apcyber-test-package was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3616 blocks this version. The OpenSSF Package Analysis project identified 'afk-react-intl' @ 99.99.99 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-4477 blocks this version. package.json declares a preinstall lifecycle script that runs `wget` against https://webhook.site/64063d25-fcd3-44e5-a454-3...
OpenSSF/OSV malware advisory MAL-2026-3302 blocks this version. The package ally-starter-api was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3302 blocks this version. The package ally-starter-api was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3301 blocks this version. The package ally-json-threat-protect was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3301 blocks this version. The package ally-json-threat-protect was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3300 blocks this version. The package ally-forms was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3300 blocks this version. The package ally-forms was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3299 blocks this version. The package ally-eagw-identity was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3299 blocks this version. The package ally-eagw-identity was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3297 blocks this version. The package ally-call-wait-time was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3297 blocks this version. The package ally-call-wait-time was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3298 blocks this version. The package ally-ccapi was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3298 blocks this version. The package ally-ccapi was found to contain malicious code.