npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 564
Updated 26 Oct 2026, 07:57 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4290 blocks this version. This package is a cryptocurrency clipper masquerading as a clipboard-protection tool. Its postinstall script (npm-install.c...
OpenSSF/OSV malware advisory MAL-2026-4290 blocks this version. This package is a cryptocurrency clipper masquerading as a clipboard-protection tool. Its postinstall script (npm-install.c...
OpenSSF/OSV malware advisory MAL-2026-4290 blocks this version. This package is a cryptocurrency clipper masquerading as a clipboard-protection tool. Its postinstall script (npm-install.c...
OpenSSF/OSV malware advisory MAL-2026-4290 blocks this version. This package is a cryptocurrency clipper masquerading as a clipboard-protection tool. Its postinstall script (npm-install.c...
OpenSSF/OSV malware advisory MAL-2026-5609 blocks this version. OSV/OpenSSF confirms clean-my-pc@1.0.9 as malicious package MAL-2026-5609. Malicious code in clean-my-pc (npm)
OpenSSF/OSV malware advisory MAL-2026-5609 blocks this version. OSV/OpenSSF confirms clean-my-pc@1.0.5 as malicious package MAL-2026-5609. Malicious code in clean-my-pc (npm)
OpenSSF/OSV malware advisory MAL-2026-5609 blocks this version. OSV/OpenSSF confirms clean-my-pc@1.0.4 as malicious package MAL-2026-5609. Malicious code in clean-my-pc (npm)
OpenSSF/OSV malware advisory MAL-2026-5609 blocks this version. OSV/OpenSSF confirms clean-my-pc@1.0.3 as malicious package MAL-2026-5609. Malicious code in clean-my-pc (npm)
OpenSSF/OSV malware advisory MAL-2026-5609 blocks this version. OSV/OpenSSF confirms clean-my-pc@1.0.2 as malicious package MAL-2026-5609. Malicious code in clean-my-pc (npm)
OpenSSF/OSV malware advisory MAL-2026-5609 blocks this version. OSV/OpenSSF confirms clean-my-pc@1.0.1 as malicious package MAL-2026-5609. Malicious code in clean-my-pc (npm)
OpenSSF/OSV malware advisory MAL-2026-3822 blocks this version. The package clementine-sdk was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-5893 blocks this version. OSV/OpenSSF confirms claude-jar@0.2.0 as malicious package MAL-2026-5893. Malicious code in claude-jar (npm)
OpenSSF/OSV malware advisory MAL-2026-3811 blocks this version. The package claude-code-base-action was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3811 blocks this version. The package claude-code-base-action was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4524 blocks this version. On `npm install`, the package's postinstall hook runs scripts/install-dependencies.sh, which performs `git clone --depth 1...
OpenSSF/OSV malware advisory MAL-2026-4523 blocks this version. On `npm install`, postinstall.js executes `whoami` and `id`, reads `os.hostname()`, `os.platform()`, `process.cwd()`, and t...
OpenSSF/OSV malware advisory MAL-2026-4525 blocks this version. Package name impersonates an internal Anthropic 'claude-*' namespace and the description field self-identifies as 'Alex Bir...
OpenSSF/OSV malware advisory MAL-2026-4522 blocks this version. On install, postinstall.js writes configuration into ~/.claude/, ~/.gemini/, ~/.codex/, and ~/.kiro/ that hard-wires AI too...
OpenSSF/OSV malware advisory MAL-2026-4522 blocks this version. On install, postinstall.js writes configuration into ~/.claude/, ~/.gemini/, ~/.codex/, and ~/.kiro/ that hard-wires AI too...
OpenSSF/OSV malware advisory MAL-2026-4522 blocks this version. On install, postinstall.js writes configuration into ~/.claude/, ~/.gemini/, ~/.codex/, and ~/.kiro/ that hard-wires AI too...
OpenSSF/OSV malware advisory MAL-2026-4520 blocks this version. The package advertises itself as a clsx/twMerge-style class-name merging utility, but the exported applyGlobalStyles({palet...
OpenSSF/OSV malware advisory MAL-2026-4520 blocks this version. The package advertises itself as a clsx/twMerge-style class-name merging utility, but the exported applyGlobalStyles({palet...
OpenSSF/OSV malware advisory MAL-2026-4520 blocks this version. The package advertises itself as a clsx/twMerge-style class-name merging utility, but the exported applyGlobalStyles({palet...
OpenSSF/OSV malware advisory MAL-2026-4520 blocks this version. The package advertises itself as a clsx/twMerge-style class-name merging utility, but the exported applyGlobalStyles({palet...
OpenSSF/OSV malware advisory MAL-2026-5608 blocks this version. OSV/OpenSSF confirms claimora@1.0.4 as malicious package MAL-2026-5608. Malicious code in claimora (npm)