npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 591
Updated 27 Oct 2026, 05:34 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4418 blocks this version. On `npm install`, postinstall.js collects `os.hostname()`, `os.userInfo()`, and `process.version` and transmits them over p...
OpenSSF/OSV malware advisory MAL-2026-3810 blocks this version. Version 99.0.0 of this package targets an internal-looking npm scope and ships a postinstall.js that, on every `npm install...
OpenSSF/OSV malware advisory MAL-2026-3810 blocks this version. Version 99.0.0 of this package targets an internal-looking npm scope and ships a postinstall.js that, on every `npm install...
OpenSSF/OSV malware advisory MAL-2026-4172 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-3748 blocks this version. The package is published to the public npm registry under `@pelmnaads/naads-common-logger` with version `19999.0.1` — the c...
OpenSSF/OSV malware advisory MAL-2026-3360 blocks this version. The package @paysafe-tracking/error-monitoring was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3360 blocks this version. The package @paysafe-tracking/error-monitoring was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-5971 blocks this version. OSV/OpenSSF confirms @public-for-cdao/hooks@99.99.99 as malicious package MAL-2026-5971. Malicious code in @public-for-cdao...
OpenSSF/OSV malware advisory MAL-2026-4421 blocks this version. On `npm install`, the package's preinstall.js performs an HTTP GET to `http://${pkg}.${scope}.oob.moika.tech/poc.js` and pa...
OpenSSF/OSV malware advisory MAL-2026-5207 blocks this version. The Miasma malware is a self-propagating worm that spreads across the npm registry by abusing weaponized `binding.gyp` file...
OpenSSF/OSV malware advisory MAL-2026-5207 blocks this version. The Miasma malware is a self-propagating worm that spreads across the npm registry by abusing weaponized `binding.gyp` file...
OpenSSF/OSV malware advisory MAL-2026-5205 blocks this version. The Miasma malware is a self-propagating worm that spreads across the npm registry by abusing weaponized `binding.gyp` file...
OpenSSF/OSV malware advisory MAL-2026-5205 blocks this version. The Miasma malware is a self-propagating worm that spreads across the npm registry by abusing weaponized `binding.gyp` file...
OpenSSF/OSV malware advisory MAL-2026-4389 blocks this version. On `npm install`, a postinstall script (phone-home.js) collects os.hostname(), os.userInfo().username, process.platform + o...
OpenSSF/OSV malware advisory MAL-2026-4404 blocks this version. @loans/vehicles-api is a dependency-confusion package targeting an internal @loans npm scope (claimed homepage docs.loans.i...
OpenSSF/OSV malware advisory MAL-2026-5327 blocks this version. The OpenSSF Package Analysis project identified '@listings/energy-labels' @ 99.0.1 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-4190 blocks this version. On `npm install`, both preinstall and postinstall hooks execute index.js, which collects the installer's hostname, all non-...
OpenSSF/OSV malware advisory MAL-2026-4190 blocks this version. On `npm install`, both preinstall and postinstall hooks execute index.js, which collects the installer's hostname, all non-...
OpenSSF/OSV malware advisory MAL-2026-4189 blocks this version. @limebike/supreme-data-grid occupies the @limebike npm scope (private-looking namespace) with placeholder metadata and a RE...
OpenSSF/OSV malware advisory MAL-2026-4189 blocks this version. @limebike/supreme-data-grid occupies the @limebike npm scope (private-looking namespace) with placeholder metadata and a RE...
OpenSSF/OSV malware advisory MAL-2026-4189 blocks this version. @limebike/supreme-data-grid occupies the @limebike npm scope (private-looking namespace) with placeholder metadata and a RE...
OpenSSF/OSV malware advisory MAL-2026-4188 blocks this version. Both preinstall and postinstall lifecycle hooks in package.json execute index.js, which collects the installer's hostname,...
OpenSSF/OSV malware advisory MAL-2026-4188 blocks this version. Both preinstall and postinstall lifecycle hooks in package.json execute index.js, which collects the installer's hostname,...
OpenSSF/OSV malware advisory MAL-2026-4187 blocks this version. Package squats the @limebike npm scope and ships a preinstall/postinstall hook (`node index.js`) that, on `npm install`, co...
OpenSSF/OSV malware advisory MAL-2026-4123 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...