npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 566
Updated 25 Oct 2026, 05:50 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-11849 blocks this version. npm/@servicetitan/data-query is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...
OpenSSF/OSV malware advisory MAL-2026-11857 blocks this version. npm/@servicetitan/dte-unlayer is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "S...
OpenSSF/OSV malware advisory MAL-2026-11863 blocks this version. npm/@servicetitan/eslint-plugin-folder-schema is affected by the large-scale, self-propagating npm supply-chain worm of 20...
OpenSSF/OSV malware advisory MAL-2026-12031 blocks this version. The package's postinstall.js runs automatically on `npm install` and harvests installer-owned secrets: it scrapes a curate...
OpenSSF/OSV malware advisory MAL-2026-12030 blocks this version. Package impersonates the bitcoinjs/bip39 project (author field set to 'bitcoinjs-lib') and ships a postinstall.js that run...
OpenSSF/OSV malware advisory MAL-2026-11860 blocks this version. npm/@servicetitan/eslint-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11860 blocks this version. npm/@servicetitan/eslint-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11860 blocks this version. npm/@servicetitan/eslint-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11860 blocks this version. npm/@servicetitan/eslint-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11860 blocks this version. npm/@servicetitan/eslint-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11860 blocks this version. npm/@servicetitan/eslint-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11773 blocks this version. npm/@ornikar/repo-config-react-legacy-css is affected by the large-scale, self-propagating npm supply-chain worm of 2026-0...
OpenSSF/OSV malware advisory MAL-2026-11770 blocks this version. npm/@ornikar/renovate-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...
OpenSSF/OSV malware advisory MAL-2026-11779 blocks this version. npm/@ornikar/typed-css-modules-loader is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04...
OpenSSF/OSV malware advisory MAL-2026-11775 blocks this version. npm/@ornikar/rollup-plugin-postcss is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (t...
OpenSSF/OSV malware advisory MAL-2026-11778 blocks this version. npm/@ornikar/stylelint-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "S...
OpenSSF/OSV malware advisory MAL-2026-11767 blocks this version. npm/@ornikar/prismic-components is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11775 blocks this version. npm/@ornikar/rollup-plugin-postcss is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (t...
OpenSSF/OSV malware advisory MAL-2026-11773 blocks this version. npm/@ornikar/repo-config-react-legacy-css is affected by the large-scale, self-propagating npm supply-chain worm of 2026-0...
OpenSSF/OSV malware advisory MAL-2026-11778 blocks this version. npm/@ornikar/stylelint-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "S...
OpenSSF/OSV malware advisory MAL-2026-11779 blocks this version. npm/@ornikar/typed-css-modules-loader is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04...
OpenSSF/OSV malware advisory MAL-2026-11770 blocks this version. npm/@ornikar/renovate-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...
OpenSSF/OSV malware advisory MAL-2026-11767 blocks this version. npm/@ornikar/prismic-components is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11778 blocks this version. npm/@ornikar/stylelint-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "S...
OpenSSF/OSV malware advisory MAL-2026-11767 blocks this version. npm/@ornikar/prismic-components is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...