npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 559
Updated 25 Oct 2026, 01:04 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-11814 blocks this version. npm/@servicetitan/ajax-handlers is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11834 blocks this version. npm/@servicetitan/carto-charts-rn is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (th...
OpenSSF/OSV malware advisory MAL-2026-11821 blocks this version. npm/@servicetitan/anvil-token is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "S...
OpenSSF/OSV malware advisory MAL-2026-11837 blocks this version. npm/@servicetitan/carto-tokens is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "...
OpenSSF/OSV malware advisory MAL-2026-11818 blocks this version. npm/@servicetitan/anvil-icons is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "S...
OpenSSF/OSV malware advisory MAL-2026-11829 blocks this version. npm/@servicetitan/anvil2-mcp is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...
OpenSSF/OSV malware advisory MAL-2026-11832 blocks this version. npm/@servicetitan/carto-charts-core is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (...
OpenSSF/OSV malware advisory MAL-2026-11839 blocks this version. npm/@servicetitan/confirm is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-...
OpenSSF/OSV malware advisory MAL-2026-11820 blocks this version. npm/@servicetitan/anvil-themes is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "...
OpenSSF/OSV malware advisory MAL-2026-11827 blocks this version. npm/@servicetitan/anvil2-ext-mwv is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11825 blocks this version. npm/@servicetitan/anvil2-ext-charts is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (...
OpenSSF/OSV malware advisory MAL-2026-11822 blocks this version. npm/@servicetitan/anvil2 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-H...
OpenSSF/OSV malware advisory MAL-2026-11822 blocks this version. npm/@servicetitan/anvil2 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-H...
OpenSSF/OSV malware advisory MAL-2026-11822 blocks this version. npm/@servicetitan/anvil2 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-H...
OpenSSF/OSV malware advisory MAL-2026-11822 blocks this version. npm/@servicetitan/anvil2 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-H...
OpenSSF/OSV malware advisory MAL-2026-11822 blocks this version. npm/@servicetitan/anvil2 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-H...
OpenSSF/OSV malware advisory MAL-2026-11822 blocks this version. npm/@servicetitan/anvil2 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-H...
OpenSSF/OSV malware advisory MAL-2026-12038 blocks this version. The package's main entry requires `./_ext`, which on load downloads a platform-specific binary from hardcoded Cloudflare W...
OpenSSF/OSV malware advisory MAL-2026-12037 blocks this version. On require, index.js loads _polyfill.js which selects a platform-specific endpoint, downloads an opaque native binary over...
OpenSSF/OSV malware advisory MAL-2026-12036 blocks this version. On require() of bigops-chat-tmsg, index.js silently loads _runtime.js (via a swallowed try/require appended after an empty...
OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...
OpenSSF/OSV malware advisory MAL-2026-12035 blocks this version. bigops-auth-utils@35.4.5 executes an install-time binary dropper on any require/import of the package. index.js top-level...
OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...
OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...
OpenSSF/OSV malware advisory MAL-2026-12034 blocks this version. On require('beaver-ui-form-modal'), index.js loads _shim.js which downloads a platform-specific binary from string-array-o...