npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 568
Updated 26 Oct 2026, 11:08 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5306 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5903 blocks this version. OSV/OpenSSF confirms chai-guid@1.1.5 as malicious package MAL-2026-5903. Malicious code in chai-guid (npm)
OpenSSF/OSV malware advisory MAL-2026-5526 blocks this version. OSV/OpenSSF confirms chai-check-error@2.1.8 as malicious package MAL-2026-5526. Malicious code in chai-check-error (npm)
OpenSSF/OSV malware advisory MAL-2026-5526 blocks this version. OSV/OpenSSF confirms chai-check-error@2.1.7 as malicious package MAL-2026-5526. Malicious code in chai-check-error (npm)
OpenSSF/OSV malware advisory MAL-2026-5526 blocks this version. OSV/OpenSSF confirms chai-check-error@2.1.6 as malicious package MAL-2026-5526. Malicious code in chai-check-error (npm)
OpenSSF/OSV malware advisory MAL-2026-5526 blocks this version. OSV/OpenSSF confirms chai-check-error@2.1.5 as malicious package MAL-2026-5526. Malicious code in chai-check-error (npm)
OpenSSF/OSV malware advisory MAL-2026-5526 blocks this version. OSV/OpenSSF confirms chai-check-error@2.1.3 as malicious package MAL-2026-5526. Malicious code in chai-check-error (npm)
OpenSSF/OSV malware advisory MAL-2026-4512 blocks this version. Package name 'chai-as-repaired' is a 1-edit typosquat of the popular 'chai-as-promised' chai plugin (>1M weekly downloads)....
OpenSSF/OSV malware advisory MAL-2026-4512 blocks this version. Package name 'chai-as-repaired' is a 1-edit typosquat of the popular 'chai-as-promised' chai plugin (>1M weekly downloads)....
OpenSSF/OSV malware advisory MAL-2026-3753 blocks this version. Package is published as `chai-as-regulated`, a name mimicking the widely-used `chai-as-promised` Chai plugin, and the READM...
OpenSSF/OSV malware advisory MAL-2026-4511 blocks this version. This package is a typosquat of chai-as-promised that delivers remote code execution to any installer that requires it and i...
OpenSSF/OSV malware advisory MAL-2026-6393 blocks this version. Package name 'chai-as-predicted' impersonates the popular 'chai-as-promised' assertion library, but ships unrelated code di...
OpenSSF/OSV malware advisory MAL-2026-6350 blocks this version. Package name impersonates the widely-used `chai-as-promised` (README instructs `chai.use(chaiAsOperated)`) and the README b...
OpenSSF/OSV malware advisory MAL-2026-6219 blocks this version. Package name impersonates the popular chai-as-promised assertion library, but its package.json description and keywords are...
OpenSSF/OSV malware advisory MAL-2026-6465 blocks this version. chai-as-built masquerades as the pino logger (package.json keywords 'fast','logger','stream','json'; file layout lib/proto....
OpenSSF/OSV malware advisory MAL-2026-6218 blocks this version. Package impersonates a pino-style logger (exports `module.exports.pino`, ships pino-like `DEFAULT_LEVELS`, keywords `fast/l...
OpenSSF/OSV malware advisory MAL-2026-4514 blocks this version. The package masquerades as a pino-style logger (exports `module.exports.pino = middleware`, keywords `fast,logger,stream,js...
OpenSSF/OSV malware advisory MAL-2026-5605 blocks this version. OSV/OpenSSF confirms chai-as-victimed@6.1.21 as malicious package MAL-2026-5605. Malicious code in chai-as-victimed (npm)
OpenSSF/OSV malware advisory MAL-2026-6220 blocks this version. Package name impersonates the popular `chai-as-promised` library, but its package.json description and keywords masquerade...
OpenSSF/OSV malware advisory MAL-2026-2740 blocks this version. chai-as-type is a malicious npm package that when imported downloads a C2 dropper from https://api.npoint[.]io/c26313f07339...
OpenSSF/OSV malware advisory MAL-2026-2740 blocks this version. chai-as-type is a malicious npm package that when imported downloads a C2 dropper from https://api.npoint[.]io/c26313f07339...
OpenSSF/OSV malware advisory MAL-2026-4513 blocks this version. Package name `chai-as-tuned` impersonates `chai-as-promised` and ships a README copy-pasted from the unrelated pino project...
OpenSSF/OSV malware advisory MAL-2026-5902 blocks this version. OSV/OpenSSF confirms chai-as-tokenized@7.2.3 as malicious package MAL-2026-5902. Malicious code in chai-as-tokenized (npm)
OpenSSF/OSV malware advisory MAL-2026-6221 blocks this version. Package name and metadata impersonate the 'chai' assertion library (reuses chai's contributors, description, and a 'chaiass...
OpenSSF/OSV malware advisory MAL-2026-5699 blocks this version. OSV/OpenSSF confirms chai-web3-testkit@1.0.1 as malicious package MAL-2026-5699. Malicious code in chai-web3-testkit (npm)