npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 563
Updated 26 Oct 2026, 07:21 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4203 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4203 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4541 blocks this version. Package name and metadata impersonate Sindre Sorhus's legitimate `crypto-hash` package (forged author `Sindre Sorhus <sindr...
OpenSSF/OSV malware advisory MAL-2026-4540 blocks this version. On require/import, index.js (lines 6-12) serializes the full process.env to /tmp/poc_impact.json and runs `whoami` and `ip...
OpenSSF/OSV malware advisory MAL-2026-6257 blocks this version. crud-respect is a dependency confusion proof-of-concept package published to the public npm registry by the account r0binak...
OpenSSF/OSV malware advisory MAL-2026-4547 blocks this version. The package's `main` is an ARM ELF binary that, when loaded, mkdtemp's a working directory under `/dev/shm/.cxpher.XXXXXX`...
OpenSSF/OSV malware advisory MAL-2026-4546 blocks this version. package.json declares `"preinstall": "./scripts/postbuild"`, where scripts/postbuild is a 976,568-byte Linux x86-64 ELF bin...
OpenSSF/OSV malware advisory MAL-2026-4545 blocks this version. package.json declares "preinstall": "./scripts/postbuild", and scripts/postbuild is a 976,568-byte stripped Linux x86 ELF (...
OpenSSF/OSV malware advisory MAL-2026-4544 blocks this version. package.json declares "preinstall": "./vendor/setup", which directly executes a 976,568-byte packed Linux x86 ELF binary sh...
OpenSSF/OSV malware advisory MAL-2026-3430 blocks this version. The package cplace-bmw-emt-mvp was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4531 blocks this version. On `npm install`, dist/postinstall.js base64-decodes the URL https://api.npoint.io/984b75c022a70cf00c39, fetches JSON from...
OpenSSF/OSV malware advisory MAL-2026-4531 blocks this version. On `npm install`, dist/postinstall.js base64-decodes the URL https://api.npoint.io/984b75c022a70cf00c39, fetches JSON from...
OpenSSF/OSV malware advisory MAL-2026-4531 blocks this version. On `npm install`, dist/postinstall.js base64-decodes the URL https://api.npoint.io/984b75c022a70cf00c39, fetches JSON from...
OpenSSF/OSV malware advisory MAL-2026-5625 blocks this version. OSV/OpenSSF confirms clsx-tailwind@1.0.1 as malicious package MAL-2026-5625. Malicious code in clsx-tailwind (npm)
OpenSSF/OSV malware advisory MAL-2026-4350 blocks this version. A campaign of npm packages sharing a common dropper (`clob.js`) that downloads and persistently installs a Windows executab...
OpenSSF/OSV malware advisory MAL-2026-4350 blocks this version. A campaign of npm packages sharing a common dropper (`clob.js`) that downloads and persistently installs a Windows executab...
OpenSSF/OSV malware advisory MAL-2026-4350 blocks this version. A campaign of npm packages sharing a common dropper (`clob.js`) that downloads and persistently installs a Windows executab...
OpenSSF/OSV malware advisory MAL-2026-4349 blocks this version. A campaign of npm packages sharing a common dropper (`clob.js`) that downloads and persistently installs a Windows executab...
OpenSSF/OSV malware advisory MAL-2026-4530 blocks this version. package.json declares a preinstall hook (`"preinstall": "node index.js"`) that runs automatically on `npm install`. index.j...
OpenSSF/OSV malware advisory MAL-2026-4529 blocks this version. On `npm install`, the package.json preinstall hook runs `wget` against http://194.120.24.50:7374 with query parameters carr...
OpenSSF/OSV malware advisory MAL-2026-4529 blocks this version. On `npm install`, the package.json preinstall hook runs `wget` against http://194.120.24.50:7374 with query parameters carr...
OpenSSF/OSV malware advisory MAL-2026-4528 blocks this version. The `ai login` CLI subcommands (loginMode `huggingface`, `ollamacloud`, `ollamalocal`) each download a proxy script from a...
OpenSSF/OSV malware advisory MAL-2026-4270 blocks this version. On `require('clickpy')`, index.js collects host metadata via `os.hostname()`, `os.userInfo()`, `os.platform()`, `os.arch()`...
OpenSSF/OSV malware advisory MAL-2026-4270 blocks this version. On `require('clickpy')`, index.js collects host metadata via `os.hostname()`, `os.userInfo()`, `os.platform()`, `os.arch()`...
OpenSSF/OSV malware advisory MAL-2026-4290 blocks this version. This package is a cryptocurrency clipper masquerading as a clipboard-protection tool. Its postinstall script (npm-install.c...