npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 567
Updated 25 Oct 2026, 06:25 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-11778 blocks this version. npm/@ornikar/stylelint-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "S...
OpenSSF/OSV malware advisory MAL-2026-11767 blocks this version. npm/@ornikar/prismic-components is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11775 blocks this version. npm/@ornikar/rollup-plugin-postcss is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (t...
OpenSSF/OSV malware advisory MAL-2026-11770 blocks this version. npm/@ornikar/renovate-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...
OpenSSF/OSV malware advisory MAL-2026-11773 blocks this version. npm/@ornikar/repo-config-react-legacy-css is affected by the large-scale, self-propagating npm supply-chain worm of 2026-0...
OpenSSF/OSV malware advisory MAL-2026-11779 blocks this version. npm/@ornikar/typed-css-modules-loader is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04...
OpenSSF/OSV malware advisory MAL-2026-11778 blocks this version. npm/@ornikar/stylelint-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "S...
OpenSSF/OSV malware advisory MAL-2026-11773 blocks this version. npm/@ornikar/repo-config-react-legacy-css is affected by the large-scale, self-propagating npm supply-chain worm of 2026-0...
OpenSSF/OSV malware advisory MAL-2026-11767 blocks this version. npm/@ornikar/prismic-components is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11775 blocks this version. npm/@ornikar/rollup-plugin-postcss is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (t...
OpenSSF/OSV malware advisory MAL-2026-11779 blocks this version. npm/@ornikar/typed-css-modules-loader is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04...
OpenSSF/OSV malware advisory MAL-2026-11770 blocks this version. npm/@ornikar/renovate-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...
OpenSSF/OSV malware advisory MAL-2026-11838 blocks this version. npm/@servicetitan/component-usage is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (th...
OpenSSF/OSV malware advisory MAL-2026-11846 blocks this version. npm/@servicetitan/cp-react-hooks is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11864 blocks this version. npm/@servicetitan/eslint-plugin-mobx-6 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-0...
OpenSSF/OSV malware advisory MAL-2026-11811 blocks this version. npm/@servicetitan/acquisition-functions is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-...
OpenSSF/OSV malware advisory MAL-2026-11852 blocks this version. npm/@servicetitan/design-system is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11861 blocks this version. npm/@servicetitan/eslint-plugin is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11830 blocks this version. npm/@servicetitan/assist-ui is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sha...
OpenSSF/OSV malware advisory MAL-2026-11872 blocks this version. npm/@servicetitan/grid is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hul...
OpenSSF/OSV malware advisory MAL-2026-11871 blocks this version. npm/@servicetitan/form-state is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...
OpenSSF/OSV malware advisory MAL-2026-11923 blocks this version. npm/@servicetitan/startup is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-...
OpenSSF/OSV malware advisory MAL-2026-11859 blocks this version. npm/@servicetitan/error-boundary is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11833 blocks this version. npm/@servicetitan/carto-charts-react is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04...
OpenSSF/OSV malware advisory MAL-2026-11826 blocks this version. npm/@servicetitan/anvil2-ext-common is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (...