npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 569
Updated 25 Oct 2026, 07:44 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-11870 blocks this version. npm/@servicetitan/form is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hul...
OpenSSF/OSV malware advisory MAL-2026-11826 blocks this version. npm/@servicetitan/anvil2-ext-common is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (...
OpenSSF/OSV malware advisory MAL-2026-11927 blocks this version. npm/@servicetitan/stylelint-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (t...
OpenSSF/OSV malware advisory MAL-2026-11871 blocks this version. npm/@servicetitan/form-state is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...
OpenSSF/OSV malware advisory MAL-2026-11872 blocks this version. npm/@servicetitan/grid is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hul...
OpenSSF/OSV malware advisory MAL-2026-11830 blocks this version. npm/@servicetitan/assist-ui is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sha...
OpenSSF/OSV malware advisory MAL-2026-11838 blocks this version. npm/@servicetitan/component-usage is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (th...
OpenSSF/OSV malware advisory MAL-2026-11846 blocks this version. npm/@servicetitan/cp-react-hooks is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11811 blocks this version. npm/@servicetitan/acquisition-functions is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-...
OpenSSF/OSV malware advisory MAL-2026-11813 blocks this version. npm/@servicetitan/admin-sql-table is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (th...
OpenSSF/OSV malware advisory MAL-2026-11852 blocks this version. npm/@servicetitan/design-system is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11861 blocks this version. npm/@servicetitan/eslint-plugin is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11923 blocks this version. npm/@servicetitan/startup is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-...
OpenSSF/OSV malware advisory MAL-2026-11841 blocks this version. npm/@servicetitan/contentful is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...
OpenSSF/OSV malware advisory MAL-2026-11842 blocks this version. npm/@servicetitan/contentful-proxy is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (t...
OpenSSF/OSV malware advisory MAL-2026-11831 blocks this version. npm/@servicetitan/assist-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "...
OpenSSF/OSV malware advisory MAL-2026-11864 blocks this version. npm/@servicetitan/eslint-plugin-mobx-6 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-0...
OpenSSF/OSV malware advisory MAL-2026-11833 blocks this version. npm/@servicetitan/carto-charts-react is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04...
OpenSSF/OSV malware advisory MAL-2026-11865 blocks this version. npm/@servicetitan/eslint-plugin-processors-stub is affected by the large-scale, self-propagating npm supply-chain worm of...
OpenSSF/OSV malware advisory MAL-2026-11862 blocks this version. npm/@servicetitan/eslint-plugin-decorators-declare is affected by the large-scale, self-propagating npm supply-chain worm...
OpenSSF/OSV malware advisory MAL-2026-11828 blocks this version. npm/@servicetitan/anvil2-illustrations is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-0...
OpenSSF/OSV malware advisory MAL-2026-11859 blocks this version. npm/@servicetitan/error-boundary is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11928 blocks this version. npm/@servicetitan/suppress-warnings is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (...
OpenSSF/OSV malware advisory MAL-2026-12029 blocks this version. sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay a...
OpenSSF/OSV malware advisory MAL-2026-12028 blocks this version. The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main,...