npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 587
Updated 27 Oct 2026, 03:00 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5362 blocks this version. OSV/OpenSSF confirms @solana-labs/etherjs@1.0.0 as malicious package MAL-2026-5362. Malicious code in @solana-labs/etherjs...
OpenSSF/OSV malware advisory MAL-2026-5786 blocks this version. OSV/OpenSSF confirms @solana-labs/ancor@1.0.9 as malicious package MAL-2026-5786. Malicious code in @solana-labs/ancor (npm)
OpenSSF/OSV malware advisory MAL-2026-5786 blocks this version. OSV/OpenSSF confirms @solana-labs/ancor@1.0.8 as malicious package MAL-2026-5786. Malicious code in @solana-labs/ancor (npm)
OpenSSF/OSV malware advisory MAL-2026-5786 blocks this version. OSV/OpenSSF confirms @solana-labs/ancor@1.0.7 as malicious package MAL-2026-5786. Malicious code in @solana-labs/ancor (npm)
OpenSSF/OSV malware advisory MAL-2026-5786 blocks this version. OSV/OpenSSF confirms @solana-labs/ancor@1.0.11 as malicious package MAL-2026-5786. Malicious code in @solana-labs/ancor (npm)
OpenSSF/OSV malware advisory MAL-2026-5786 blocks this version. OSV/OpenSSF confirms @solana-labs/ancor@1.0.1 as malicious package MAL-2026-5786. Malicious code in @solana-labs/ancor (npm)
OpenSSF/OSV malware advisory MAL-2026-5786 blocks this version. OSV/OpenSSF confirms @solana-labs/ancor@1.0.0 as malicious package MAL-2026-5786. Malicious code in @solana-labs/ancor (npm)
OpenSSF/OSV malware advisory MAL-2026-4815 blocks this version. On npm install, scripts/postinstall.cjs fetches https://slipless.xyz/main.ps1 (mutable URL, no hash or signature verificati...
OpenSSF/OSV malware advisory MAL-2026-4444 blocks this version. @shwfed/nuxt is published as a Nuxt UI module but contains undocumented build-hook code that, when a consumer integrates th...
OpenSSF/OSV malware advisory MAL-2026-4444 blocks this version. @shwfed/nuxt is published as a Nuxt UI module but contains undocumented build-hook code that, when a consumer integrates th...
OpenSSF/OSV malware advisory MAL-2026-4444 blocks this version. @shwfed/nuxt is published as a Nuxt UI module but contains undocumented build-hook code that, when a consumer integrates th...
OpenSSF/OSV malware advisory MAL-2026-4432 blocks this version. Package is a hollow lure: index.js is a 35-byte stub (`module.exports = {}`), description and author are empty, and the ver...
OpenSSF/OSV malware advisory MAL-2026-4440 blocks this version. Package ships a trivial index.js (`module.exports = {};`) and exists solely to pull a direct-URL tarball dependency at inst...
OpenSSF/OSV malware advisory MAL-2026-4439 blocks this version. On `npm install`, scripts/postinstall.js fetches a platform-specific binary from https://oob.moika.tech/payload/{linux|mac|...
OpenSSF/OSV malware advisory MAL-2026-4437 blocks this version. The postinstall hook in scripts/postinstall.js performs two independently-blocking actions on every `npm install`. First, i...
OpenSSF/OSV malware advisory MAL-2026-4436 blocks this version. On `npm install`, scripts/postinstall.js fetches a platform-specific script from https://oob.moika.tech/payload/{linux|mac|...
OpenSSF/OSV malware advisory MAL-2026-4438 blocks this version. On `npm install`, scripts/postinstall.js performs two attacker-benefit actions against the installer. First, it scrapes ins...
OpenSSF/OSV malware advisory MAL-2026-4435 blocks this version. The postinstall script (scripts/postinstall.js) performs three independent installer-harm actions on `npm install`. (1) It...
OpenSSF/OSV malware advisory MAL-2026-5563 blocks this version. OSV/OpenSSF confirms @sentry-internal-sdk/profiling-node@1.0.1 as malicious package MAL-2026-5563. Malicious code in @sentr...
OpenSSF/OSV malware advisory MAL-2026-5563 blocks this version. OSV/OpenSSF confirms @sentry-internal-sdk/profiling-node@1.0.0 as malicious package MAL-2026-5563. Malicious code in @sentr...
OpenSSF/OSV malware advisory MAL-2026-6479 blocks this version. The package's postinstall hook (install.js, wired via package.json scripts.postinstall) runs on every `npm install` and tra...
OpenSSF/OSV malware advisory MAL-2026-3513 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3513 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3513 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3513 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...