npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 558
Updated 26 Oct 2026, 03:43 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5182 blocks this version. The OpenSSF Package Analysis project identified 'brave-search-mcp-server' @ 1.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-3306 blocks this version. The package bpmn-studio was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6249 blocks this version. On `npm install`, the package's `preinstall` lifecycle hook runs `curl` against `http://d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.o...
OpenSSF/OSV malware advisory MAL-2026-5716 blocks this version. OSV/OpenSSF confirms beamz@1.0.8 as malicious package MAL-2026-5716. Malicious code in beamz (npm)
OpenSSF/OSV malware advisory MAL-2026-5716 blocks this version. OSV/OpenSSF confirms beamz@1.0.5 as malicious package MAL-2026-5716. Malicious code in beamz (npm)
OpenSSF/OSV malware advisory MAL-2026-5716 blocks this version. OSV/OpenSSF confirms beamz@1.0.14 as malicious package MAL-2026-5716. Malicious code in beamz (npm)
OpenSSF/OSV malware advisory MAL-2026-5716 blocks this version. OSV/OpenSSF confirms beamz@1.0.13 as malicious package MAL-2026-5716. Malicious code in beamz (npm)
OpenSSF/OSV malware advisory MAL-2026-5716 blocks this version. OSV/OpenSSF confirms beamz@1.0.12 as malicious package MAL-2026-5716. Malicious code in beamz (npm)
OpenSSF/OSV malware advisory MAL-2026-5716 blocks this version. OSV/OpenSSF confirms beamz@1.0.11 as malicious package MAL-2026-5716. Malicious code in beamz (npm)
OpenSSF/OSV malware advisory MAL-2026-4497 blocks this version. package.json declares `bin.claude = bin/claude-win.cjs` and `bin.claude-linux = bin/claude` under a non-Anthropic publisher...
OpenSSF/OSV malware advisory MAL-2026-4497 blocks this version. package.json declares `bin.claude = bin/claude-win.cjs` and `bin.claude-linux = bin/claude` under a non-Anthropic publisher...
OpenSSF/OSV malware advisory MAL-2026-5924 blocks this version. OSV/OpenSSF confirms binproto@1.0.7 as malicious package MAL-2026-5924. Malicious code in binproto (npm)
OpenSSF/OSV malware advisory MAL-2026-5924 blocks this version. OSV/OpenSSF confirms binproto@1.0.5 as malicious package MAL-2026-5924. Malicious code in binproto (npm)
OpenSSF/OSV malware advisory MAL-2026-4498 blocks this version. build/bitrix24/client.js line 6-7 declares `const BITRIX24_WEBHOOK_URL = process.env.BITRIX24_WEBHOOK_URL || 'https://svilu...
OpenSSF/OSV malware advisory MAL-2026-4498 blocks this version. build/bitrix24/client.js line 6-7 declares `const BITRIX24_WEBHOOK_URL = process.env.BITRIX24_WEBHOOK_URL || 'https://svilu...
OpenSSF/OSV malware advisory MAL-2026-4498 blocks this version. build/bitrix24/client.js line 6-7 declares `const BITRIX24_WEBHOOK_URL = process.env.BITRIX24_WEBHOOK_URL || 'https://svilu...
OpenSSF/OSV malware advisory MAL-2026-4498 blocks this version. build/bitrix24/client.js line 6-7 declares `const BITRIX24_WEBHOOK_URL = process.env.BITRIX24_WEBHOOK_URL || 'https://svilu...
OpenSSF/OSV malware advisory MAL-2026-4498 blocks this version. build/bitrix24/client.js line 6-7 declares `const BITRIX24_WEBHOOK_URL = process.env.BITRIX24_WEBHOOK_URL || 'https://svilu...
OpenSSF/OSV malware advisory MAL-2026-6447 blocks this version. based-32 advertises itself as a zero-dependency RFC4648 Base32 encoding library, but `dist/index.js` ships a hidden trigger...
OpenSSF/OSV malware advisory MAL-2026-6447 blocks this version. based-32 advertises itself as a zero-dependency RFC4648 Base32 encoding library, but `dist/index.js` ships a hidden trigger...
OpenSSF/OSV malware advisory MAL-2026-6228 blocks this version. When a user runs the package's `jcc` or `jcx` CLI, lib/ai_utils.js polls https://jai.jaskle.cn/hm/hm_pub/ai_cc_cfg for a `n...
OpenSSF/OSV malware advisory MAL-2026-6228 blocks this version. When a user runs the package's `jcc` or `jcx` CLI, lib/ai_utils.js polls https://jai.jaskle.cn/hm/hm_pub/ai_cc_cfg for a `n...
OpenSSF/OSV malware advisory MAL-2026-6150 blocks this version. The npm package `barcodescanner-reconnect` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React...
OpenSSF/OSV malware advisory MAL-2026-4496 blocks this version. bandkit ships a React/Solidity 'strategy bot' library whose deployment helper hardcodes an XOR-obfuscated Ethereum address...
OpenSSF/OSV malware advisory MAL-2026-4496 blocks this version. bandkit ships a React/Solidity 'strategy bot' library whose deployment helper hardcodes an XOR-obfuscated Ethereum address...