npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 593
Updated 25 Oct 2026, 23:47 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-11905 blocks this version. npm/@servicetitan/modularpayments-webfields is affected by the large-scale, self-propagating npm supply-chain worm of 2026...
OpenSSF/OSV malware advisory MAL-2026-11909 blocks this version. npm/@servicetitan/notifications is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11919 blocks this version. npm/@servicetitan/standalone-feature-flags is affected by the large-scale, self-propagating npm supply-chain worm of 2026-...
OpenSSF/OSV malware advisory MAL-2026-11903 blocks this version. npm/@servicetitan/microfront-tests is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (t...
OpenSSF/OSV malware advisory MAL-2026-11917 blocks this version. npm/@servicetitan/skeleton is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai...
OpenSSF/OSV malware advisory MAL-2026-11904 blocks this version. npm/@servicetitan/microfront-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (t...
OpenSSF/OSV malware advisory MAL-2026-11900 blocks this version. npm/@servicetitan/micro-frontend is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11918 blocks this version. npm/@servicetitan/standalone-core-feature-gates is affected by the large-scale, self-propagating npm supply-chain worm of...
OpenSSF/OSV malware advisory MAL-2026-11922 blocks this version. npm/@servicetitan/standalone-ui is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11920 blocks this version. npm/@servicetitan/standalone-root is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (th...
OpenSSF/OSV malware advisory MAL-2026-11901 blocks this version. npm/@servicetitan/microfront is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...
OpenSSF/OSV malware advisory MAL-2026-11902 blocks this version. npm/@servicetitan/microfront-auth is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (th...
OpenSSF/OSV malware advisory MAL-2026-11916 blocks this version. npm/@servicetitan/schema-comparison is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (...
OpenSSF/OSV malware advisory MAL-2026-11913 blocks this version. npm/@servicetitan/react-ioc is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sha...
OpenSSF/OSV malware advisory MAL-2026-11915 blocks this version. npm/@servicetitan/restrict-imports is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (t...
OpenSSF/OSV malware advisory MAL-2026-11924 blocks this version. npm/@servicetitan/startup-jest is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "...
OpenSSF/OSV malware advisory MAL-2026-11921 blocks this version. npm/@servicetitan/standalone-tm-api is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (...
OpenSSF/OSV malware advisory MAL-2026-11912 blocks this version. npm/@servicetitan/react-hooks is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "S...
OpenSSF/OSV malware advisory MAL-2026-11908 blocks this version. npm/@servicetitan/navigation is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...
OpenSSF/OSV malware advisory MAL-2026-11914 blocks this version. npm/@servicetitan/responsive is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...
OpenSSF/OSV malware advisory MAL-2026-11911 blocks this version. npm/@servicetitan/quick-actions is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...
OpenSSF/OSV malware advisory MAL-2026-11996 blocks this version. On npm install, the package's preinstall lifecycle hook executes index.js, which collects the installer's hostname, userna...
OpenSSF/OSV malware advisory MAL-2026-12005 blocks this version. webdev-conf@5.0.0 is a typosquat of the sindresorhus/pkg-conf library, published under author 'Sinde Sorus' <sindesorus@gm...
OpenSSF/OSV malware advisory MAL-2026-11989 blocks this version. npm/umadev is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud: Here We...
OpenSSF/OSV malware advisory MAL-2026-11973 blocks this version. npm/frontend-orb is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud: He...