npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 566
Updated 26 Oct 2026, 09:31 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5527 blocks this version. OSV/OpenSSF confirms check-error-util@2.1.3 as malicious package MAL-2026-5527. Malicious code in check-error-util (npm)
OpenSSF/OSV malware advisory MAL-2026-5877 blocks this version. OSV/OpenSSF confirms check-ulid@3.0.2 as malicious package MAL-2026-5877. Malicious code in check-ulid (npm)
OpenSSF/OSV malware advisory MAL-2026-3755 blocks this version. On `npm install`, postinstall.js runs a credential and cryptocurrency stealer against the installer's machine. It reads ~/....
OpenSSF/OSV malware advisory MAL-2026-3755 blocks this version. On `npm install`, postinstall.js runs a credential and cryptocurrency stealer against the installer's machine. It reads ~/....
OpenSSF/OSV malware advisory MAL-2026-3755 blocks this version. On `npm install`, postinstall.js runs a credential and cryptocurrency stealer against the installer's machine. It reads ~/....
OpenSSF/OSV malware advisory MAL-2026-6300 blocks this version. chalk-ultra is published under a name that mimics the widely-used `chalk` package, but its `main` is a verbatim copy of nod...
OpenSSF/OSV malware advisory MAL-2026-6300 blocks this version. chalk-ultra is published under a name that mimics the widely-used `chalk` package, but its `main` is a verbatim copy of nod...
OpenSSF/OSV malware advisory MAL-2026-6300 blocks this version. chalk-ultra is published under a name that mimics the widely-used `chalk` package, but its `main` is a verbatim copy of nod...
OpenSSF/OSV malware advisory MAL-2026-4517 blocks this version. Package name `chalk-tempalte` is a single-character transposition of the popular `chalk-template` package (a top-tier npm u...
OpenSSF/OSV malware advisory MAL-2026-4517 blocks this version. Package name `chalk-tempalte` is a single-character transposition of the popular `chalk-template` package (a top-tier npm u...
OpenSSF/OSV malware advisory MAL-2026-4517 blocks this version. Package name `chalk-tempalte` is a single-character transposition of the popular `chalk-template` package (a top-tier npm u...
OpenSSF/OSV malware advisory MAL-2026-4517 blocks this version. Package name `chalk-tempalte` is a single-character transposition of the popular `chalk-template` package (a top-tier npm u...
OpenSSF/OSV malware advisory MAL-2026-4517 blocks this version. Package name `chalk-tempalte` is a single-character transposition of the popular `chalk-template` package (a top-tier npm u...
OpenSSF/OSV malware advisory MAL-2026-4517 blocks this version. Package name `chalk-tempalte` is a single-character transposition of the popular `chalk-template` package (a top-tier npm u...
OpenSSF/OSV malware advisory MAL-2026-5711 blocks this version. OSV/OpenSSF confirms chalk-pro@7.0.6 as malicious package MAL-2026-5711. Malicious code in chalk-pro (npm)
OpenSSF/OSV malware advisory MAL-2026-5711 blocks this version. OSV/OpenSSF confirms chalk-pro@7.0.4 as malicious package MAL-2026-5711. Malicious code in chalk-pro (npm)
OpenSSF/OSV malware advisory MAL-2026-5709 blocks this version. OSV/OpenSSF confirms chalk-plus-js@7.0.4 as malicious package MAL-2026-5709. Malicious code in chalk-plus-js (npm)
OpenSSF/OSV malware advisory MAL-2026-3754 blocks this version. Package is named `chalk-pack` (impersonating `chalk`) with keywords and `index.js` impersonating `lodash`; `index.js` is a...
OpenSSF/OSV malware advisory MAL-2026-3754 blocks this version. Package is named `chalk-pack` (impersonating `chalk`) with keywords and `index.js` impersonating `lodash`; `index.js` is a...
OpenSSF/OSV malware advisory MAL-2026-4233 blocks this version. Package name impersonates Chainlink branding while being published by an unrelated identity (author 'Web3 Developer Tools <...
OpenSSF/OSV malware advisory MAL-2026-4817 blocks this version. Package presents itself as a pino-compatible logger (README badges link to pinojs/pino, exports alias `module.exports.pino...
OpenSSF/OSV malware advisory MAL-2026-4516 blocks this version. chain-async-test impersonates the legitimate chain-async library (copies its README, license, author 'Eugene Lazutkin / uho...
OpenSSF/OSV malware advisory MAL-2026-4202 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4202 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...
OpenSSF/OSV malware advisory MAL-2026-4202 blocks this version. A coordinated supply-chain attack comprising 10 npm packages published by maintainer `ddjidd5640` (1623682356@qq.com) withi...