npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 560
Updated 25 Oct 2026, 01:47 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-12034 blocks this version. On require('beaver-ui-form-modal'), index.js loads _shim.js which downloads a platform-specific binary from string-array-o...
OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...
OpenSSF/OSV malware advisory MAL-2026-12051 blocks this version. On require of the package's main entry, _compat.js downloads a platform-specific binary from Cloudflare Workers subdomains...
OpenSSF/OSV malware advisory MAL-2026-12042 blocks this version. The package's index.js unconditionally loads _bridge.js on require. _bridge.js downloads a platform-specific native binary...
OpenSSF/OSV malware advisory MAL-2026-12049 blocks this version. On require of the package, _platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers host...
OpenSSF/OSV malware advisory MAL-2026-12050 blocks this version. The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload...
OpenSSF/OSV malware advisory MAL-2026-12041 blocks this version. On require() of the package, index.js loads./_compat.js whose top-level init() downloads a platform-specific binary from a...
OpenSSF/OSV malware advisory MAL-2026-12034 blocks this version. On require('beaver-ui-form-modal'), index.js loads _shim.js which downloads a platform-specific binary from string-array-o...
OpenSSF/OSV malware advisory MAL-2026-12039 blocks this version. The package advertises itself as a data-formatting utility but ships a postinstall.js that auto-executes on npm install an...
OpenSSF/OSV malware advisory MAL-2026-12039 blocks this version. The package advertises itself as a data-formatting utility but ships a postinstall.js that auto-executes on npm install an...
OpenSSF/OSV malware advisory MAL-2026-12054 blocks this version. index.js has malicious code appended after a legitimate Tailwind plugin export. On any require()/import of the package, th...
OpenSSF/OSV malware advisory MAL-2026-12047 blocks this version. index.mjs schedules an asynchronous routine at module load that decodes a table of hex-encoded strings to reconstruct refe...
OpenSSF/OSV malware advisory MAL-2026-10777 blocks this version. The package advertises itself as an n8n community-node utility but its main entry index.js executes a recon routine at mod...
OpenSSF/OSV malware advisory MAL-2026-12029 blocks this version. sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay a...
OpenSSF/OSV malware advisory MAL-2026-11869 blocks this version. npm/@servicetitan/forge is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hu...
OpenSSF/OSV malware advisory MAL-2026-11857 blocks this version. npm/@servicetitan/dte-unlayer is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "S...
OpenSSF/OSV malware advisory MAL-2026-11866 blocks this version. npm/@servicetitan/examples is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai...
OpenSSF/OSV malware advisory MAL-2026-11847 blocks this version. npm/@servicetitan/cp-ui is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hu...
OpenSSF/OSV malware advisory MAL-2026-11850 blocks this version. npm/@servicetitan/datadog-rum is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "S...
OpenSSF/OSV malware advisory MAL-2026-11856 blocks this version. npm/@servicetitan/dte-pdf-editor is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11854 blocks this version. npm/@servicetitan/docs-uikit is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...
OpenSSF/OSV malware advisory MAL-2026-11843 blocks this version. npm/@servicetitan/cp-api is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-H...
OpenSSF/OSV malware advisory MAL-2026-11873 blocks this version. npm/@servicetitan/hammer-icon is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "S...
OpenSSF/OSV malware advisory MAL-2026-11849 blocks this version. npm/@servicetitan/data-query is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...
OpenSSF/OSV malware advisory MAL-2026-11844 blocks this version. npm/@servicetitan/cp-mfe is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-H...