npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 557
Updated 26 Oct 2026, 03:13 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3804 blocks this version. The package bui-react-10components was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6151 blocks this version. The npm package `buildautomation-touch` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Nat...
OpenSSF/OSV malware advisory MAL-2026-6151 blocks this version. The npm package `buildautomation-touch` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Nat...
OpenSSF/OSV malware advisory MAL-2026-6196 blocks this version. Package name suggests build telemetry tooling, but the tarball ships beacon scripts (beacon18.js, beacon_linux.js) wired to...
OpenSSF/OSV malware advisory MAL-2026-4276 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4276 blocks this version. Ten packages published by npm user `asdxzxc` at version 1.0.10 target developers working on AI and LLM tooling. Each packag...
OpenSSF/OSV malware advisory MAL-2026-4232 blocks this version. The package contains no functionality of its own. Its `postinstall` lifecycle hook runs `npx env-security-scanner@latest au...
OpenSSF/OSV malware advisory MAL-2026-6349 blocks this version. package.json declares `preinstall: node index.js`, causing index.js to run automatically on `npm install`. The script colle...
OpenSSF/OSV malware advisory MAL-2026-2920 blocks this version. On require/import, index.js decodes a base64 string literal to https://www.jsonkeeper.com/b/CWOV9, fetches that anonymous J...
OpenSSF/OSV malware advisory MAL-2026-2920 blocks this version. On require/import, index.js decodes a base64 string literal to https://www.jsonkeeper.com/b/CWOV9, fetches that anonymous J...
OpenSSF/OSV malware advisory MAL-2026-2920 blocks this version. On require/import, index.js decodes a base64 string literal to https://www.jsonkeeper.com/b/CWOV9, fetches that anonymous J...
OpenSSF/OSV malware advisory MAL-2026-6348 blocks this version. The package declares a postinstall hook (`"postinstall": "node run.js"`) that executes run.js automatically on `npm install...
OpenSSF/OSV malware advisory MAL-2026-3423 blocks this version. The package byvendors was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3423 blocks this version. The package byvendors was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3846 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-3846 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-3307 blocks this version. The package browserslist-db was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4500 blocks this version. bricks-builder-mcp is a Model Context Protocol server exposing WordPress/Bricks Builder editing tools (page JSON edits, med...
OpenSSF/OSV malware advisory MAL-2026-4500 blocks this version. bricks-builder-mcp is a Model Context Protocol server exposing WordPress/Bricks Builder editing tools (page JSON edits, med...
OpenSSF/OSV malware advisory MAL-2026-4500 blocks this version. bricks-builder-mcp is a Model Context Protocol server exposing WordPress/Bricks Builder editing tools (page JSON edits, med...
OpenSSF/OSV malware advisory MAL-2026-4500 blocks this version. bricks-builder-mcp is a Model Context Protocol server exposing WordPress/Bricks Builder editing tools (page JSON edits, med...
OpenSSF/OSV malware advisory MAL-2026-5182 blocks this version. The OpenSSF Package Analysis project identified 'brave-search-mcp-server' @ 1.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-3306 blocks this version. The package bpmn-studio was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6249 blocks this version. On `npm install`, the package's `preinstall` lifecycle hook runs `curl` against `http://d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.o...
OpenSSF/OSV malware advisory MAL-2026-5716 blocks this version. OSV/OpenSSF confirms beamz@1.0.8 as malicious package MAL-2026-5716. Malicious code in beamz (npm)