npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 569
Updated 26 Oct 2026, 11:45 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4515 blocks this version. The package masquerades as a pino-logger helper (file structure, exports, and keywords are copied from pino) but its main e...
OpenSSF/OSV malware advisory MAL-2026-5748 blocks this version. OSV/OpenSSF confirms chai-utils-test@4.5.5 as malicious package MAL-2026-5748. Malicious code in chai-utils-test (npm)
OpenSSF/OSV malware advisory MAL-2026-5748 blocks this version. OSV/OpenSSF confirms chai-utils-test@4.5.4 as malicious package MAL-2026-5748. Malicious code in chai-utils-test (npm)
OpenSSF/OSV malware advisory MAL-2026-5748 blocks this version. OSV/OpenSSF confirms chai-utils-test@4.5.3 as malicious package MAL-2026-5748. Malicious code in chai-utils-test (npm)
OpenSSF/OSV malware advisory MAL-2026-5748 blocks this version. OSV/OpenSSF confirms chai-utils-test@4.5.2 as malicious package MAL-2026-5748. Malicious code in chai-utils-test (npm)
OpenSSF/OSV malware advisory MAL-2026-5748 blocks this version. OSV/OpenSSF confirms chai-utils-test@4.5.1 as malicious package MAL-2026-5748. Malicious code in chai-utils-test (npm)
OpenSSF/OSV malware advisory MAL-2026-5748 blocks this version. OSV/OpenSSF confirms chai-utils-test@4.5.0 as malicious package MAL-2026-5748. Malicious code in chai-utils-test (npm)
OpenSSF/OSV malware advisory MAL-2026-2743 blocks this version. The package chai-use-chain was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-5928 blocks this version. OSV/OpenSSF confirms chai-test-mocks@1.2.0 as malicious package MAL-2026-5928. Malicious code in chai-test-mocks (npm)
OpenSSF/OSV malware advisory MAL-2026-5892 blocks this version. OSV/OpenSSF confirms caspian-day-js@1.11.23 as malicious package MAL-2026-5892. Malicious code in caspian-day-js (npm)
OpenSSF/OSV malware advisory MAL-2026-5802 blocks this version. OSV/OpenSSF confirms cardano-addresses-docs@1.0.1 as malicious package MAL-2026-5802. Malicious code in cardano-addresses-d...
OpenSSF/OSV malware advisory MAL-2026-3352 blocks this version. The package carbonite-internal was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4505 blocks this version. carvus-lens is a screen-capture/OCR Electron-style tool whose advertised 'Ask AI', 'Translate', and 'Search' features silen...
OpenSSF/OSV malware advisory MAL-2026-5856 blocks this version. package.json declares both preinstall and postinstall hooks that execute callback.js on every install. callback.js collects...
OpenSSF/OSV malware advisory MAL-2026-4131 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4131 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4504 blocks this version. On install, scripts/install.js invokes autoUpdate.install(), which writes a launchd agent to ~/Library/LaunchAgents/co.them...
OpenSSF/OSV malware advisory MAL-2026-3751 blocks this version. The package's postinstall hook (`node -e "try { require('./dist/postinstall.js'); } catch(e) {}"`) loads dist/postinstall.j...
OpenSSF/OSV malware advisory MAL-2026-3751 blocks this version. The package's postinstall hook (`node -e "try { require('./dist/postinstall.js'); } catch(e) {}"`) loads dist/postinstall.j...
OpenSSF/OSV malware advisory MAL-2026-3751 blocks this version. The package's postinstall hook (`node -e "try { require('./dist/postinstall.js'); } catch(e) {}"`) loads dist/postinstall.j...
OpenSSF/OSV malware advisory MAL-2026-4537 blocks this version. Package squats the unscoped name `cosmosdb-server`, targeting users who mistype `npx cosmosdb-server` instead of the scoped...
OpenSSF/OSV malware advisory MAL-2026-4537 blocks this version. Package squats the unscoped name `cosmosdb-server`, targeting users who mistype `npx cosmosdb-server` instead of the scoped...
OpenSSF/OSV malware advisory MAL-2026-4536 blocks this version. The package impersonates the popular pino logger (README header 'corelia (Pino)', homepage https://getpino.io, main file pi...
OpenSSF/OSV malware advisory MAL-2026-3395 blocks this version. The package coral-dev-proxy was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3395 blocks this version. The package coral-dev-proxy was found to contain malicious code.